Massive supply chain attack targets 3CX phone system users.
Security researchers have discovered a supply chain attack targeting downstream customers of 3CX's voice and video-calling client, which is used by over 600,000 organizations worldwide. The trojanized version of the software is capable of stealing data and stored credentials from Google Chrome, Microsoft Edge, Brave, and Firefox user profiles. The attack appears to be a targeted Advanced Persistent Threat, possibly state-sponsored, and North Korean threat actor Labyrinth Chollima is suspected to be behind it. 3CX is urging its customers to uninstall the app and install it again or use its PWA client as a workaround.