FortiGuard Labs reported CVE-2023-29059 as a trojanized 3CX Desktop App supply-chain compromise affecting Electron-based Windows versions 18.12.407 and 18.12.416 and macOS versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416. The malicious chain uses sideloaded ffmpeg.dll to read an encrypted blob from d3dcompiler_47.dll, decrypt shellcode, and attempt to pull ICO files from a now-removed GitHub repository that contained download URIs for later payloads. The source identifies malicious installer and DLL hashes, notes 3CX’s large global customer base, and advises discontinuing older desktop clients while using the unaffected web-based PWA option. Fortinet also mapped detections and blocked network indicators tied to the attack, but the core CTI finding is the compromised signed 3CX desktop software and staged payload delivery path.