Symantec reported that North Korea-linked actors compromised multiple Windows and macOS versions of 3CX DesktopApp in a supply-chain attack that trojanized legitimate installers to deploy information-stealing malware. The malicious installers sideloaded a modified `ffmpeg.dll`, which loaded payload material from `d3dcompiler_47.dll`; the encrypted blob began with `FEEDFACE`, decrypted into shellcode, and executed a third DLL that attempted to retrieve icon files from a GitHub repository. The campaign affected a widely used voice and video calling client and resembled a SolarWinds-style compromise, with the collected host information likely used to decide which victims should receive follow-on intrusion activity. Symantec listed affected installer/app hashes, attacker-controlled domains, and the GitHub path used by the malware, while 3CX advised users to uninstall the desktop app and temporarily use the PWA client until clean builds were available.