Rapid7 analyzed the 3CXDesktopApp Windows supply-chain compromise after multiple vendors observed malicious activity from a legitimate signed communications application on Windows and macOS. The MSI drops benign 3CXDesktopApp.exe, which loads backdoored ffmpeg.dll; that DLL reads an RC4-encrypted blob from d3dcompiler.dll and reflectively loads code that retrieves .ico files with appended Base64 command-and-control data from GitHub. Rapid7 MDR observed the backdoored installer in several customer environments and identified affected Electron Windows versions 18.12.407 and 18.12.416 and macOS versions 18.11.1213, 18.12.402, 18.12.407, and 18.12.416. The source recommends uninstalling 3CXDesktopApp, using the PWA client temporarily, and hunting known malicious domains and hashes associated with the campaign.