3CX DesktopApp Targeted in Active Intrusion Campaign

Alert:

We have become aware that an Active Intrusion Campaign targeting the 3CX Desktop App has now been detected. It has been advised that users with the affected Desktop Application take immediate action.

Mitigation Action:

The following steps could assist resellers in mitigating this issue until there is a formal response and resolution from 3CX.

Remove the affected desktop application from all end-user systems.
Remove the installation files from the 3CX instance they are located in /var/lib/3cxpbx/Instance1/Data/Http/electron/windows/
Download the following zip file from https://3cx.ucreseller.co.uk/windows.zip
Copy the files onto the 3CX instance in the following folder /var/lib/3cxpbx/Instance1/Data/Http/electron/windows/
Please note that these files have been renamed to look like u7 files but are, in fact, u5 files. We believe the affected files are 18.12.416; the files included within the ZIP are 18.10.461.
You can then download the client from the web app and provision the extension.

Or

You could remove the desktop application from all end-user systems and use the web app until there is a response and resolution from 3CX.

3CX Responses:

30/03/2023 – 6:27 AM Nick Galea wrote:

Hi

As many of you have noticed the 3CX DesktopApp has a malware in it. It affects the Windows Electron client for customers running update 7. It was reported to us yesterday night and we are working on an update to the DesktopApp which we will release in the coming hours.

The best way to go about this is to uninstall the app (if you are running Windows Defender, its going to do this automatically for you unfortunately) and then install it again. We are going to analyze and issue a full report later on today. Right now we are just focusing on the update.

We strongly recommend using our PWA client instead. It really does 99% of the client app and is fully web based and this type of thing can never happen. Only thing you dont have is hotkeys and BLF. But in light of what happened yesterday we are going to address BLF immediately and hotkeys if we can.

So please use PWA for the moment until we release a new build. And consider using PWA instead of Electron.

Furthermore my team and myself apologize profusely for this issue.

Nick Galea
3CX

https://www.3cx.com/community/threads/3cx-desktopapp-security-alert.119951/