Splunk frames the 3CXDesktopApp incident as a software supply-chain compromise affecting signed desktop client builds and provides defensive hunting guidance for customers investigating endpoint and network telemetry. The described chain begins with affected 3CXDesktopApp MSI versions loading a trojanized ffmpeg.dll, which reads d3dcompiler_47.dll, decrypts RC4-encrypted shellcode with key 3jB(2bsG#c7, and loads a DLL that sleeps, reads the MachineGUID, and fetches .ico files from a GitHub repository. Those icon files contain encoded and encrypted C2 URLs that lead to configuration data and a final x64 browser-stealer DLL. The payload collects host details and targets browser history or SQLite data from Chrome, Firefox, Microsoft Edge, and Brave, making the source most useful for defenders building detections around the 3CX infection chain rather than for broad attribution claims.