3CX Cascading Supply-Chain Compromise

A signed, trusted desktop softphone starts behaving like malware after a routine update: it side-loads an invalidly-signed DLL, pulls a hidden payload from icon files, beacons out over HTTPS with a fixed cookie, steals browser credentials, and stages service persistence on the build host. There is no obviously-bad executable to flag, the detection is the anomalous behaviour of a trusted application. Work the endpoint image-loads and process tree, the SIEM DNS and network records, and the perimeter egress to reconstruct the intrusion.