BTC $68,822.08 -4.22%
ETH $1,937.54 -3.87%
BNB $633.97 -3.30%
XRP $1.02 -0.66%
SOL $80.03 -1.88%
TRX $0.3126 -1.01%
DOGE $0.0653 -0.96%
ADA $0.1709 -0.40%
BCH $223.54 -0.65%
LINK $9.94 -0.53%
HYPE $72.53 +1.97%
AAVE $111.26 -2.11%
SUI $0.8040 +0.71%
XLM $0.1482 +1.38%
ZEC $944.59 -0.01%
AAPL $357.59 +0.46%
AMZN $265.76 -1.33%
GOOGL $295.41 -2.07%
MSFT $524.91 -0.70%
META $634.88 +1.52%
NVDA $160.91 -2.88%
TSLA $389.94 -0.52%
SNDK $860.82 -8.58%
INTC $58.74 -5.09%
SPCX $138.94 -2.55%
MU $761.59 -3.96%
AMD $522.29 -9.84%
BTC $68,822.08 -4.22%
ETH $1,937.54 -3.87%
BNB $633.97 -3.30%
XRP $1.02 -0.66%
SOL $80.03 -1.88%
TRX $0.3126 -1.01%
DOGE $0.0653 -0.96%
ADA $0.1709 -0.40%
BCH $223.54 -0.65%
LINK $9.94 -0.53%
HYPE $72.53 +1.97%
AAVE $111.26 -2.11%
SUI $0.8040 +0.71%
XLM $0.1482 +1.38%
ZEC $944.59 -0.01%
AAPL $357.59 +0.46%
AMZN $265.76 -1.33%
GOOGL $295.41 -2.07%
MSFT $524.91 -0.70%
META $634.88 +1.52%
NVDA $160.91 -2.88%
TSLA $389.94 -0.52%
SNDK $860.82 -8.58%
INTC $58.74 -5.09%
SPCX $138.94 -2.55%
MU $761.59 -3.96%
AMD $522.29 -9.84%

desk

All
Article
Flash

Slow Fog: Udesk customer service script was implanted with malicious code that can steal user session data and replace recharge addresses

According to Slow Fog's disclosure, its security personnel discovered that the script udeskApi.2026-10-16.cached.js related to the Udesk customer service system was implanted with a malicious loader during routine threat intelligence checks. This loader hides the address through hexadecimal encoding and asynchronously loads the remote script deeps.js (sourced from udeskqlobal[.]com, note that the domain name starts with the letter q). This script reads accessible Cookies, localStorage, and sessionStorage on the page, intercepts form and login/authentication requests, and sends data to udeskqlobal[.]com/c.php. Attackers may use this to impersonate sessions or take over accounts. This data collection behavior is not restricted by the target site's rules, and unmatched pages may also be affected.According to Slow Fog's analysis, this script also targets three types of sites: mgbx[.]com, bikingex[.], and bitxex[.]io, scanning the recharge page every 200 milliseconds and replacing identified recharge addresses with preset BTC, EVM, TRON, Solana, LTC, and DOGE addresses. At the same time, the script manipulates the clipboard API, replaces copy buttons, and intercepts copy events, making users see and copy tampered addresses. If users transfer funds to this address, the money will flow into the attacker's address.

first_img Robinhood's social trading feature is open to qualified users in the United States and will be available on the Legend desktop platform

Robinhood announced that its social trading network is now open to all eligible users in the United States. CEO Vlad Tenev stated on October 13 that this feature is built into the app's information feed, centered around users' trades and performance. Users can follow other traders, view shared account activities, and initiate eligible trades directly from posts through the Quick trade feature. Tenev mentioned that Robinhood Social is now available to everyone, allowing users to share charts, profits and losses, and portfolio allocations, as well as receive news and company updates.This feature was previously tested starting on March 18, initially for 1,000 customers who attended the HOOD Summit, followed by an additional 10,000 in the subsequent weeks. The early version provided verified trading posts, daily and yearly profit and loss statistics, and the ability to place orders manually from the information feed; news feeds are part of future planning. Sharing is selective: trades will not be automatically published, and customers can choose which eligible trades to publish, as well as disable trading statistics in their profiles.Access and publishable content are restricted. Social is only available in the United States, and Robinhood excludes licensed securities professionals, individuals associated with regulated financial institutions, and the company's own employees. Its help page indicates that futures and multi-leg options trades currently do not meet publishing criteria. Tenev stated that Social will be coming to Robinhood's desktop trading platform Legend in the coming weeks.

first_img DeepSeek Harness v0.2 preview version released, desktop installation package launched

Phoenix Technology reported that on September 29, the DeepSeek Harness v0.2 preview version was officially released, providing installation packages for macOS and Windows desktop, and is now available on the DeepSeek official website. The new version comes pre-equipped with commonly used features for daily office work and development, and introduces a plugin installation and management page.This update optimizes file display, content preview, and code change display, improves the settings and management of automated tasks, and offers various ways to showcase work processes. Users can provide documents, spreadsheets, or PDFs for organizing materials, analyzing data, generating charts, or creating presentations, and can also modify projects and run code.The built-in automation task plugin can be activated as needed, supporting the scheduling of repetitive tasks and allowing users to view running records, adjust execution frequency, and task instructions. The plugin management page supports installing by entering the plugin package name, as well as disabling, uninstalling plugins, and viewing introductions and sources; in the experimental creative mode, users can describe their needs through dialogue, allowing it to write and modify plugins. The official statement indicates that the product is still in its early stages and will continue to improve the sandbox and security, agent teams, long-term memory, browser and other GUI software automation, remote and mobile usage, and explore session sharing and multi-user collaboration. According to the official model API user statistics, about 60% of users have used third-party plugins.
app_icon
ChainCatcher Building the Web3 world with innovations.