Loading story…
Attackers compromised the signed Windows and macOS installers for 3CXDesktopApp, causing deployed clients to beacon to attacker-controlled infrastructure and download second-stage payloads. The malicious Windows installer dropped backdoored components including ffmpeg.dll, which extracted and memory-loaded the SUDDENICON payload from d3dcompiler_47.dll; the malware delayed execution for roughly seven days, retrieved encoded C2 domains hidden in GitHub-hosted icon files, transmitted a machine identifier, and fetched an additional encrypted executable believed to be an information stealer.
CrowdStrike observed limited hands-on-keyboard activity and assessed the campaign as a supply-chain intrusion, citing beacon encryption and structure matching a prior campaign attributed with high confidence to DPRK-linked LABYRINTH CHOLLIMA. Elastic reported code similarities between the SUDDENICON loader and DPRK-associated APPLEJEUS tooling. Organizations should remove compromised 3CXDesktopApp installations, investigate historical DNS and endpoint activity for associated indicators, and retain or enable detections for shellcode execution, process injection, suspicious processes, and memory-resident threats.
Trace attribution and downstream blast radius.
10 events from the most recent confirmed update back to the earliest known activity.
CrowdStrike Falcon OverWatch observed signed 3CXDesktopApp binaries on Windows and macOS beaconing to attacker infrastructure, deploying second-stage payloads, and, in a limited number of cases, being used for hands-on-keyboard activity. CrowdStrike assessed a signed 3CX MSI as malicious, identifying a compromised ffmpeg.dll as a central component and suspecting LABYRINTH CHOLLIMA involvement.
Potentially malicious activity associated with the 3CXDesktopApp supply-chain compromise began around March 22. The compromise enabled adversary-controlled components to be distributed through 3CX update channels.
The GitHub IconStorages repository used to stage encoded C2-domain data was most recently updated before the 3CX compromise was publicly identified.
CrowdStrike later determined that the 3CX malware's HTTPS beacon structure and encryption key matched a campaign attributed with high confidence to the DPRK-nexus actor LABYRINTH CHOLLIMA.
A GitHub account created the IconStorages repository later used by SUDDENICON to retrieve encoded command-and-control domains concealed in icon files.
AppleJeus targeting of cryptocurrency-related victims was reported across more than 30 countries beginning in January 2020, affecting sectors including energy, finance, government, technology, and telecommunications.
The Union Crypto AppleJeus variant was identified and marketed through unioncrypto.vip; reporting indicated Windows victims may also have received it through Telegram downloads.
Researchers identified the JMT Trading AppleJeus variant, which was distributed through jmttrading.org and a linked GitHub page and used a scheduled task for persistence on Windows.
Open-source reporting disclosed Celas Trade Pro, a trojanized Q.T. Bitcoin Trader application associated with the DPRK-linked AppleJeus activity. The campaign led to infection with the FALLCHILL remote-access tool.
CrowdStrike cited Patrick Wardle's reverse engineering of a weaponized 3CX macOS binary, which identified a sleep function likely intended to evade dynamic analysis.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 71 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
5 references tracked. Mallory keeps watching after this page renders.
elastic.co
Open sourcereddit.com
Open sourcecisa.gov
Open source3cx.com
Open source3cx.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A supply-chain compromise of **3CXDesktopApp** delivered the **SmoothOperator** malware to Windows and macOS users, turning a widely used enterprise PBX and conferencing client into a staged malware loader. SentinelLabs reported that trojanized Windows installers triggered detections after a spike in malicious activity, with the application loading shellcode, reflectively loading DLLs, retrieving poisoned `.ico` files from GitHub containing appended Base64 data, decrypting a command-and-control URL, and ultimately deploying a third-stage infostealer that harvested host information and browser history. On macOS, investigators found a malicious `libffmpeg.dylib` embedded in the installer; it was code-signed and notarized at discovery, then later revoked by Apple. Technical analysis of the Windows payload chain showed a two-DLL staging process in which an initial DLL acted as a PE loader for `d3dcompiler_47.dll`, searched for a marker in its Security directory, unpacked shellcode, and mapped an in-memory 64-bit DLL before transferring execution to `DllGetClassObject`. Researchers noted API hashing consistent with Metasploit-style routines, a hard-coded **3CXDesktopApp** user-agent string, and possible anti-emulation logic using `cpuid`. On macOS, the first stage collected environment data, contacted a hardcoded C2, and dropped **UpdateAgent**, which gathered 3CX account and provisioning details before self-deleting. Mandiant later said the backdoor on 3CX’s macOS build server was **POOLRAT**, not **SIMPLESEA**, linking the intrusion to malware previously associated with **Lazarus** activity, though attribution remained cautious at the time.
Aug 21, 2026
A supply-chain compromise of the **3CX Desktop App** caused legitimate, signed Windows and macOS clients to distribute malware, an incident tracked as **`CVE-2023-29059`**. Investigations by VMware, Rapid7, Fortinet, and Splunk found that affected Electron-based builds, including Windows versions **18.12.407** and **18.12.416** and several macOS releases, contained a maliciously altered bundled library. On Windows, the attack chain used a sideloaded **`ffmpeg.dll`** to decrypt or load code hidden in **`d3dcompiler_47.dll`**, then contact attacker-controlled infrastructure through GitHub-hosted `.ico` files that concealed command-and-control data. Researchers reported that the malware collected host identifiers such as the **MachineGUID**, reached out to malicious domains and GitHub repositories for second-stage payloads, and ultimately delivered a browser-stealing DLL targeting data from **Chrome, Firefox, Edge, and Brave**. VMware telemetry observed related command-and-control traffic as early as early March, while Fortinet said victim connections were concentrated in Europe and North America. 3CX revoked the certificate for the prior Windows version, said malicious domains and the GitHub repository were taken down, and advised customers to uninstall the desktop client and temporarily use the browser-based **Progressive Web App (PWA)** while defenders hunt for indicators of compromise and block known-bad infrastructure.
Aug 15, 2026
Attackers ran a multi-stage information-stealing campaign against victims in Latin America and Asia Pacific by distributing password-protected archives disguised as pirated software. Trellix reported that the infection chain abused legitimate **Cisco Webex** binaries for **DLL sideloading**, which launched **HijackLoader** and then **Vidar Stealer** through an **AutoIt3** component, enabling theft of browser credentials and communication with command-and-control infrastructure. The campaign used several defense-evasion and post-compromise techniques, including a **COM-based UAC bypass**, adding **Windows Defender** exclusions, and injecting into **`MSBuild.exe`**. Trellix said the malware also fetched additional payloads and ultimately launched a cryptominer via **`AddInProcess.exe`**, describing the operation as a fresh and evasive threat with low detections in threat feeds despite clear execution-chain visibility in EDR telemetry.
Aug 14, 2026