Hackers exploit TrueConf zero-day to push malicious software updates

Check Point disclosed active exploitation of a TrueConf zero-day (CVE-2026-3502) that abuses a missing integrity check in the update mechanism to distribute malicious updates and execute arbitrary files on connected endpoints; the "TrueChaos" campaign is attributed with moderate confidence to a Chinese-nexus actor targeting government entities in Southeast Asia, leveraging DLL sideloading, UAC bypass, and likely the Havoc C2 framework, affecting TrueConf versions 8.1.0–8.5.2 and patched in 8.5.3.