3CX Desktop Client Trojanized for Supply-Chain Attacks

ReliaQuest reports that a legitimately signed 3CX Desktop Client was trojanized in a supply-chain campaign (SmoothOperator) attributed to the Lazarus Group; the compromise uses a first-stage loader that fetches a second-stage infostealer via Base64-encoded icon files on GitHub, with observed C2 domains and IOCs, and customers are advised to uninstall the desktop client, disable automatic updates, and use the PWA client until remediation is available.