Threat Advisory: 3CX Softphone Supply Chain Compromise
Summary: Cisco Talos reported a supply chain attack that abused the legitimate update function of the 3CX softphone app to deliver malicious payloads to Windows and macOS users, using DLL sideloading and, on Windows, a seven-day sleep cycle before retrieving further artifacts from a now-removed GitHub repository. Talos observed file activity dating to February 3, 2023, while the GitHub repository had been active since December 2022, and the domains behind the attack were first registered as early as February 2022.
What's compelling: 3CX claims over 600,000 customers and 12 million daily users, and the second-stage payloads are information stealers that pull system data and browsing history, which Talos says may be used to filter and discard some victims while keeping access to others.
Read the original at Cisco Talos ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026