3CX: when the signed installer is the malware
A real, signed 3CX desktop app shipped with malware inside. What to do, and why “it’s signed” isn’t enough.
Last week security companies found that the 3CX desktop app, used by many businesses for calls, was shipping with malware inside. Not a fake download: the official installer, signed by 3CX, from 3CX’s own site.
The attackers got into the build process, so the bad code was signed along with the good. Antivirus tools trusted it at first for exactly that reason.
If you use 3CX:
- Follow 3CX’s advice: uninstall the affected desktop app and use the web client until a clean version is confirmed.
- Check your security tools for the published indicators, and look at the machines that had it installed.
For everyone else, the lesson is uncomfortable. Signing proves who built the software, not that it’s safe. So:
- Watch behaviour, not just files. A phone app talking to strange servers is a signal on its own.
- Limit what desktop apps can reach on the network.
- Know which vendors ship code onto every PC. They’re part of your security now.