Threat Advisory: 3CX Softphone Supply Chain Compromise

• Cisco Talos is tracking and actively responding to a supply chain attack involving the 3CX Desktop Softphone application.
• This is a multi-stage attack that involves sideloading DLLs, seven-day sleep routines, and additional payloads dependent on a now-removed GitHub repository for Windows based systems.
• MacOS systems used a different infection chain

3cx advisory application attack cisco cisco talos compromise desktop github infection macos repository sideloading sleep stage supply supply chain supply chain attack supply chain compromise systems talos threat threat advisory tracking windows