#Macupdate desktop software for mac#

3CX lists customer organizations in the following sectors: The company website claims that 3CX has 600,000 customer companies with 12 million daily users. Our telemetry now sets the earliest infection attempt as March 8th, 2023.ģCXDesktopApp is a voice and video conferencing Private Automatic Branch Exchange (PABX) enterprise call routing software developed by 3CX, a business communications software company. We have updated our IOCs to reflect macOS components.

#Macupdate desktop software for mac#

We have identified the limited deployment of a second-stage payload for Mac infections.

March 30th, 2023: We can confirm that the macOS installer is trojanized, as reported by Patrick Wardle.

March 30th, 2023: We have updated our IOCs with contributions from the research community.

The threat actor has registered a sprawling set of infrastructure starting as early as February 2022, but we don’t yet see obvious connections to existing threat clusters.

Our investigation into the threat actor behind this supply chain is ongoing.The compromise includes a code signing certificate used to sign the trojanized binaries.The trojanized 3CXDesktopApp is the first stage in a multi-stage attack chain that pulls ICO files appended with base64 data from Github and ultimately leads to a 3rd stage infostealer DLL still being analyzed as of the time of writing.

Behavioral detections prevented these trojanized installers from running and led to immediate default quarantine.As of SentinelOne began to see a spike in behavioral detections of the 3CXDesktopApp, a popular voice and video conferencing software product categorized as a Private Automatic Branch Exchange (PABX) platform.By Juan Andres Guerrero-Saade, Asaf Gilboa, David Acs, James Haughom & SentinelLabs Executive Summary