A Comprehensive Analysis of the 3CX Attack

A widespread supply-chain compromise of the 3CX DesktopApp delivered a digitally signed Trojanized installer (Windows and macOS) that drops malicious DLLs (ffmpeg.dll and d3dcompiler_47.dll). The ffmpeg DLL decrypts embedded shellcode via RC4 which loads an embedded DLL that waits seven days, retrieves Base64 + AES-GCM encrypted C2 URLs from ICO files in a GitHub repo, and downloads a final stealer capable of harvesting system information and browser credentials; the campaign affected a large installed base (3CX claims ~600,000 companies / 12M daily users) and includes numerous IOCs and mitigation guidance.