Security firm SlowMist discovered malicious code injected into scripts associated with the Udesk customer service system, capable of stealing user data and replacing cryptocurrency deposit addresses. The compromised JavaScript samples harvest cookies, browser storage, and sensitive information from forms and authentication requests, potentially exposing user sessions and account credentials. The malicious script also modifies deposit addresses displayed on targeted websites and tampers with clipboard contents, redirecting funds to attacker-controlled addresses. SlowMist recommends affected websites immediately stop loading contaminated scripts, restore trusted versions, investigate data exfiltration records, revoke leaked sessions, and change credentials in clean environments. Users are advised to independently verify deposit addresses and transaction records through trusted channels before completing transfers.