There has been a recent supply chain attack that targets 12 million users of a phone system

A number of security companies have warned about an ongoing supply chain attack that targets downstream clients by employing a trojanized version of 3CX’s popular audio and video calling client.

More than 600,000 businesses utilize a software-based phone system created by 3CX, including American Express, BMW, McDonald’s, and the National Health Service of the United Kingdom. The business asserts that it has more than 12 million daily users worldwide.

On Wednesday, researchers from the cybersecurity firms CrowdStrike, Sophos, and SentinelOne released blog posts describing a SolarWinds-style attack that uses trojanized 3CXDesktopApp installers to deliver infostealer malware inside corporate networks. SentinelOne has dubbed this attack “Smooth Operator.”

This malware is able to access user profiles for Google Chrome, Microsoft Edge, Brave, and Firefox and collect information about the system as well as steal data and stored credentials. Additional malicious activity that has been seen, according to CrowdStrike, includes beaconing to actor-controlled infrastructure, deploying second-stage payloads, and, in a tiny number of instances, “hands-on-keyboard activity.”

Security experts claim that the hacked VoIP program is being attacked on both Windows and macOS. The Linux, iOS, and Android versions seem to be unaffected right now.

On March 22, SentinelOne researchers first noticed suspicious activity. They looked into the anomalies right away and learned that certain companies were attempting to install a trojanized version of the 3CX desktop app that had been signed with a legitimate digital certificate. Additionally, Apple has notarized the virus, which indicates that no malware was found when it was searched for by the business, according to Apple security expert Patrick Wardle.

The company is aware of a “security vulnerability” affecting its Windows and MacBook applications, according to 3CX CISO Pierre Jourdan’s statement on Thursday.

According to Jourdan, it appears that this was a “targeted attack by an Advanced Persistent Threat, possibly even state-sponsored” hacker. According to CrowdStrike, the supply-chain attack was carried out by the renowned Lazarus Group subsection Labyrinth Chollima, a North Korean threat actor.

The 3CX company is advising its customers to either use its PWA client or to remove the app and reinstall it as a solution. In the interim, we really regret what happened, and we’ll do everything in our ability to make amends, Jourdan added.

We still don’t know a much about the 3CX supply-chain assault, including how many firms may have been affected. There are presently more than 240,000 publicly exposed 3CX phone management systems, according to Shodan.io, a website that tracks internet-connected devices.