Malicious Code Hidden in Customer Support Script

A recent security disclosure has uncovered a sophisticated attack involving a compromised script used by a customer support system. Investigators found a malicious loader embedded within the script, which used techniques like hexadecimal encoding to conceal its purpose before fetching a more powerful payload from a remote server.

The Attack: Session Hijacking and Data Theft

The core malicious script executes a multi-pronged attack. It first harvests sensitive data accessible through the browser, including cookies and local storage objects. Furthermore, it actively intercepts form submissions, particularly those related to login and authentication processes, and exfiltrates this data to an attacker-controlled domain.

This allows threat actors to potentially hijack user sessions, impersonate legitimate users, and gain unauthorized access to accounts, posing significant risks to both data privacy and asset security.

A Financial Twist: Real-Time Cryptocurrency Address Replacement

Beyond credential theft, this campaign exhibits a clear financial motive. The code specifically targets the deposit pages of several cryptocurrency trading platforms. It continuously scans the page and, upon detecting a deposit address field, dynamically replaces it with addresses controlled by the attacker.

The targeted blockchain networks include:

  • Bitcoin (BTC)
  • EVM chains (e.g., Ethereum)
  • TRON
  • Solana
  • Litecoin (LTC)
  • Dogecoin (DOGE)

To make the scam more effective, the malware also hijacks the clipboard API. Even if a user attempts to copy the address manually, the pasted result is the attacker's address, significantly increasing the success rate of the fraud.

Response and Mitigation Steps

Given the severity of this threat, the identified indicators of compromise (IOCs) have been integrated into a threat detection engine. For potentially affected users and organizations, the following actions are recommended:

  • Identify and immediately cease distribution or use of the reported, compromised script version.
  • All users should revoke active sessions and rotate passwords, API keys, and other sensitive tokens from a confirmed clean device.
  • When making cryptocurrency deposits, always verify the receiving address through official backend channels or secondary confirmation methods, not solely relying on front-end display.
  • Carefully review recent transaction history to confirm deposits reached the intended official addresses.

This attack exploits trust in commonly used web services and tools. Maintaining software vigilance and promoting security awareness remain essential defenses against such evolving threats.