Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
7 IOCs
Threat Intelligence | Udesk Loads Malicious JS to Steal Data and Alter Transfer Addresses
Excerpt
Background Recently, SlowMist security personnel detected an attack involving the injection of malicious code into scripts associated with the Udesk customer service system during routine threat intelligence investigations. The team subsequently obtained two JavaScript samples, udeskApi.2026-10-16.cached.js and deeps.js, and analyzed them to investigate how the malicious code entered webpages through customer service scripts and what it did to user data and business…
Read the original report →Diamond Model
Adversary
Infrastructure(4)
Capability
Victim
Indicators of Compromise
Open the mindmap →7 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| URL | https://udeskqlobal.com/c.php | High | Score 58/100 | First seen |
| Domain | bitxex.io | High | Score 58/100 | First seen |
| SHA256 | 57c1441c4f5bb3260981a2df64f9ff35f117abde0d8667c8c66a047880074c59 | Medium | Score 53/100 | First seen |
| URL | https://udeskqlobal.com/deeps.js | High | Score 58/100 | First seen |
| SHA256 | 68747470733a2f2f756465736b716c6f62616c2e636f6d2f64656570732e6a73 | Medium | Score 53/100 | First seen |
| SHA256 | 45b4e8f160d8d5177819f6c1dc67acc7abbdc65eeaffc909e668799dc778bcf6 | Medium | Score 53/100 | First seen |
| Domain | mgbx.com | High | Score 58/100 | First seen |
IOC Relationship Graph
Building graph…