Lazarus trojanizes 3CX macOS app via libffmpeg.dylib
Researchers confirmed the 3CX supply chain attack also trojanized the macOS desktop app, hiding a downloader inside a notarized libffmpeg.dylib library.
Sourceobjective-see.org — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
Following CrowdStrike's disclosure of a supply chain compromise of the 3CX VOIP desktop client, Objective-See conducted independent analysis to confirm what other vendors could not: that the macOS version of 3CXDesktopApp was indeed trojanized. The malicious code was found embedded in libffmpeg.dylib, a Mach-O universal binary bundled inside the legitimate, Apple-notarized application. Despite passing Apple's notarization checks and being undetected by all AV engines on VirusTotal at time of analysis, the library contained XOR-obfuscated strings, anti-debugging timing checks, and dynamically resolved APIs designed to frustrate analysis.
Dynamic analysis via lldb revealed the malware spawns a thread that builds a session-lock file path, collects host information (OS version, hostname), generates a UUID, and writes an XOR-encrypted state file. It then constructs and beacons to a hardcoded C2 URL (pbxsources.com/queue) using a spoofed Windows Chrome user-agent, expecting an HTTP 200 response before downloading and executing a second-stage payload named UpdateAgent via chmod and popen. At the time of analysis the C2 domain was already sinkholed/offline (NXDOMAIN), preventing full second-stage retrieval, though the embedded domain list matches infrastructure previously seen in the Windows variant of the same campaign.
Apple has since revoked the code-signing certificate used to notarize the trojanized application, rescinding its notarization status. The activity has been publicly attributed by CrowdStrike to the Lazarus Group, targeting an application used by roughly 600,000 companies and 12 million users worldwide, making this a significant and ongoing supply chain threat with both Windows and macOS components sharing common C2 infrastructure.
Mentioned in this report
Detection guidance
macOS Process Spawning Thread with Session Lock and XOR State File Creation
A behavioural hunt for the technique in general.
Detects macOS processes creating session-lock files and writing XOR-encrypted state files after spawning threads - indicative of trojanized library collecting host info and maintaining persistence state. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Process Spawning Thread with Session Lock and XOR State File Creation
description: Detects processes that spawn threads and create session-lock file paths
followed by writing encrypted state files. This pattern is associated with trojanized
libraries collecting system information and maintaining encrypted state for C2 communication.
tags:
- attack.discovery
- attack.t1082
- attack.t1027
logsource:
category: process_creation
product: macos
detection:
selection_thread_spawn:
CommandLine|contains:
- pthread_create
- dispatch_async
selection_lock_file:
CommandLine|contains:
- session.lock
- .lock
selection_xor_state:
CommandLine|contains:
- XOR
- state
- encrypted
condition: selection_thread_spawn and selection_lock_file and selection_xor_state
falsepositives:
- Legitimate multi-threaded applications managing session state
- Development tools and debugging utilities
level: medium
id: 78fdef1d-fa1c-5eac-9d98-3578edde34a5
status: experimental
author: Vorant
macOS Trojanized Library Executing Second-Stage Payload via chmod and popen
A behavioural hunt for the technique in general.
Detects libffmpeg.dylib or similar bundled libraries spawning child processes executing chmod followed by popen to launch UpdateAgent - indicative of trojanized library delivering and executing second-stage malware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: macOS Trojanized Library Executing Second-Stage Payload via chmod and popen
description: Detects bundled/embedded dynamic libraries (libffmpeg.dylib) spawning
chmod and popen to download, make executable, and launch second-stage payloads (UpdateAgent).
This is characteristic of trojanized supply-chain compromises delivering staged
malware.
tags:
- attack.execution
- attack.t1105
- attack.t1195.002
logsource:
category: process_creation
product: macos
detection:
selection_parent:
ParentImage|endswith: libffmpeg.dylib
selection_chmod:
Image|endswith: chmod
CommandLine|contains:
- +x
- '755'
selection_popen:
CommandLine|contains:
- UpdateAgent
- popen
condition: selection_parent and (selection_chmod or selection_popen)
falsepositives:
- Legitimate plugin systems extracting and executing libraries from bundles
- Development and testing frameworks
level: high
id: d5f7c396-8a6e-5a61-b677-1d49d8a492fb
status: experimental
author: Vorant
1 more detection for this report is in the app — an indicator rule with Sigma, Splunk SPL, Elastic, Microsoft Defender XDR KQL, and YARA. Free account, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://objective-see.org/blog/blog_0x73.html
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the actors, malware, and campaigns it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs