Loading story…
A supply-chain compromise of 3CXDesktopApp delivered the SmoothOperator malware to Windows and macOS users, turning a widely used enterprise PBX and conferencing client into a staged malware loader. SentinelLabs reported that trojanized Windows installers triggered detections after a spike in malicious activity, with the application loading shellcode, reflectively loading DLLs, retrieving poisoned .ico files from GitHub containing appended Base64 data, decrypting a command-and-control URL, and ultimately deploying a third-stage infostealer that harvested host information and browser history. On macOS, investigators found a malicious libffmpeg.dylib embedded in the installer; it was code-signed and notarized at discovery, then later revoked by Apple.
Technical analysis of the Windows payload chain showed a two-DLL staging process in which an initial DLL acted as a PE loader for d3dcompiler_47.dll, searched for a marker in its Security directory, unpacked shellcode, and mapped an in-memory 64-bit DLL before transferring execution to DllGetClassObject. Researchers noted API hashing consistent with Metasploit-style routines, a hard-coded 3CXDesktopApp user-agent string, and possible anti-emulation logic using cpuid. On macOS, the first stage collected environment data, contacted a hardcoded C2, and dropped UpdateAgent, which gathered 3CX account and provisioning details before self-deleting. Mandiant later said the backdoor on 3CX’s macOS build server was POOLRAT, not SIMPLESEA, linking the intrusion to malware previously associated with Lazarus activity, though attribution remained cautious at the time.
Trace attribution and downstream blast radius.
8 events from the most recent confirmed update back to the earliest known activity.
On March 29, 2023, cybersecurity vendors announced a supply-chain attack affecting 3CXDesktopApp users. Initial reporting attributed the intrusion campaign to the North Korean-linked threat actor Labyrinth Chollima.
SentinelOne observed a spike in behavioral detections involving 3CXDesktopApp beginning March 22, 2023. Its protections blocked execution of trojanized installers and quarantined them by default.
SentinelLabs reported that infrastructure used in the 3CX SmoothOperator campaign had registration dates going back to at least February 2022.
On April 24, 2023, SentinelLabs added additional technical details covering both the Windows and macOS variants of the 3CX malware.
A malware-analysis write-up documented the SmoothOperator two-DLL staging process, including a first-stage PE loader, shellcode that maps a DLL in memory, Metasploit-style API hashing, and execution via DllGetClassObject.
SentinelLabs updated indicators of compromise for the 3CX campaign on March 30, 2023 with contributions from the research community.
Apple revoked the code signature and notarization for the trojanized macOS 3CX application on March 30, 2023 after public reporting.
On March 30, 2023, SentinelLabs confirmed that the macOS 3CX installer was also trojanized, matching earlier triage by Patrick Wardle. The malicious package used a crafted libffmpeg.dylib inside the app bundle.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 55 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
securityscorecard.com
Open sourcegithub.com
Open sourcesentinelone.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply-chain compromise of the **3CX Desktop App** caused legitimate, signed Windows and macOS clients to distribute malware, an incident tracked as **`CVE-2023-29059`**. Investigations by VMware, Rapid7, Fortinet, and Splunk found that affected Electron-based builds, including Windows versions **18.12.407** and **18.12.416** and several macOS releases, contained a maliciously altered bundled library. On Windows, the attack chain used a sideloaded **`ffmpeg.dll`** to decrypt or load code hidden in **`d3dcompiler_47.dll`**, then contact attacker-controlled infrastructure through GitHub-hosted `.ico` files that concealed command-and-control data. Researchers reported that the malware collected host identifiers such as the **MachineGUID**, reached out to malicious domains and GitHub repositories for second-stage payloads, and ultimately delivered a browser-stealing DLL targeting data from **Chrome, Firefox, Edge, and Brave**. VMware telemetry observed related command-and-control traffic as early as early March, while Fortinet said victim connections were concentrated in Europe and North America. 3CX revoked the certificate for the prior Windows version, said malicious domains and the GitHub repository were taken down, and advised customers to uninstall the desktop client and temporarily use the browser-based **Progressive Web App (PWA)** while defenders hunt for indicators of compromise and block known-bad infrastructure.
Aug 15, 2026
Attackers compromised the signed Windows and macOS installers for **3CXDesktopApp**, causing deployed clients to beacon to attacker-controlled infrastructure and download second-stage payloads. The malicious Windows installer dropped backdoored components including `ffmpeg.dll`, which extracted and memory-loaded the **SUDDENICON** payload from `d3dcompiler_47.dll`; the malware delayed execution for roughly seven days, retrieved encoded C2 domains hidden in GitHub-hosted icon files, transmitted a machine identifier, and fetched an additional encrypted executable believed to be an information stealer. CrowdStrike observed limited hands-on-keyboard activity and assessed the campaign as a supply-chain intrusion, citing beacon encryption and structure matching a prior campaign attributed with high confidence to DPRK-linked **LABYRINTH CHOLLIMA**. Elastic reported code similarities between the SUDDENICON loader and DPRK-associated **APPLEJEUS** tooling. Organizations should remove compromised 3CXDesktopApp installations, investigate historical DNS and endpoint activity for associated indicators, and retain or enable detections for shellcode execution, process injection, suspicious processes, and memory-resident threats.
Sep 9, 2026
Researchers reported an active malware supply-chain campaign distributing trojanized Windows installers that abuse DLL sideloading to launch **STX RAT** in memory through a malicious `CRYPTBASE.dll`. Confirmed lures included fake packages for **CPU-Z**, **X-VPN**, **Binance**, **MEXC**, **Bybit**, **Exodus**, **MetaTrader 5**, and a Steam-themed decoy, with infrastructure tied to `supp0v3[.]com` and an actor tracked as **Leda Elacoate**. In the X-VPN case, investigators said the vendor's official channels were not compromised; only users who downloaded the repackaged installer from attacker-controlled sources were exposed. X-VPN later released Windows version **77.5.3** with hardening changes after disclosure of the DLL search-order weakness. Incident analysis of the CPU-Z lure showed the intrusion extending well beyond initial access. After STX RAT execution, the operator deployed **PureLogs Stealer** for credential theft and **PureHVNC** via `InstallUtil.exe`, then staged prolonged data theft using **rclone** tunneled through a hidden **QEMU Alpine** virtual machine acting as a proxy. The observed operation lasted about five days and included roughly **54 hours** of continuous exfiltration to `94.156.119[.]71:443`, illustrating a coordinated crimeware workflow that combined fake software distribution, remote access, credential harvesting, and covert exfiltration.
Jul 12, 2026