SlowMist’s cybersecurity team found malicious JavaScript in scripts used by the Udesk customer support system while analyzing two files. SlowMist said the code could steal credentials and other user data on any site using the compromised widget; displaying the chat window in an iframe did not prevent access to data on the main page.
A separate module could replace cryptocurrency deposit addresses on three specified platforms and alter copied text, creating a risk that users would send funds to attackers. SlowMist urged affected companies to stop distributing the compromised scripts, revoke exposed credentials and check deposit addresses against trusted data.
