Cybersecurity in the News: 3CX Desktop App compromise

ThreatLocker confirms a compromise of the 3CX desktop application: a signed 3CX MSI was used to drop two malicious DLLs that deliver a payload while 3CXDesktopApp.exe itself appears not malicious. Affected versions identified are 18.12.416 and 18.12.407; ThreatLocker recommends creating a deny policy for the reported files, applying Ringfencing to limit application access, and using their built-in application definitions to block the compromised files.