A malicious script embedded in UDESK customer service chat widgets can silently swap cryptocurrency addresses between what is displayed on screen and what gets copied to the clipboard, according to blockchain security firm SlowMist. The malware also has the capability to steal login credentials from victims. SlowMist warns that a common user safeguard—verifying the copied address against the same webpage after pasting—is ineffective against this attack, since both the display and clipboard content are manipulated by the script simultaneously. Users who rely on copy-paste workflows for wallet transactions remain exposed to fund theft without obvious warning signs.