VORANT. Threat Intelligence Sign in Get the full feed

Lazarus trojanizes 3CX macOS app via libffmpeg.dylib

routine threat telecommunications

Researchers confirmed the 3CX supply chain attack also trojanized the macOS desktop app, hiding a downloader inside a notarized libffmpeg.dylib library.

Following CrowdStrike's disclosure of a supply chain compromise of the 3CX VOIP desktop client, Objective-See conducted independent analysis to confirm what other vendors could not: that the macOS version of 3CXDesktopApp was indeed trojanized. The malicious code was found embedded in libffmpeg.dylib, a Mach-O universal binary bundled inside the legitimate, Apple-notarized application. Despite passing Apple's notarization checks and being undetected by all AV engines on VirusTotal at time of analysis, the library contained XOR-obfuscated strings, anti-debugging timing checks, and dynamically resolved APIs designed to frustrate analysis.

Dynamic analysis via lldb revealed the malware spawns a thread that builds a session-lock file path, collects host information (OS version, hostname), generates a UUID, and writes an XOR-encrypted state file. It then constructs and beacons to a hardcoded C2 URL (pbxsources.com/queue) using a spoofed Windows Chrome user-agent, expecting an HTTP 200 response before downloading and executing a second-stage payload named UpdateAgent via chmod and popen. At the time of analysis the C2 domain was already sinkholed/offline (NXDOMAIN), preventing full second-stage retrieval, though the embedded domain list matches infrastructure previously seen in the Windows variant of the same campaign.

Apple has since revoked the code-signing certificate used to notarize the trojanized application, rescinding its notarization status. The activity has been publicly attributed by CrowdStrike to the Lazarus Group, targeting an application used by roughly 600,000 companies and 12 million users worldwide, making this a significant and ongoing supply chain threat with both Windows and macOS components sharing common C2 infrastructure.

Mentioned in this report

Threat actors Lazarus Group
Malware SmoothOperatorUpdateAgentlibffmpeg.dylib
Campaigns 3CX Supply Chain AttackSmoothOperator

Detection guidance

macOS Process Spawning Thread with Session Lock and XOR State File Creation

ATT&CK T1082

Detects macOS processes creating session-lock files and writing XOR-encrypted state files after spawning threads - indicative of trojanized library collecting host info and maintaining persistence state. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Spawning Thread with Session Lock and XOR State File Creation
description: Detects processes that spawn threads and create session-lock file paths
  followed by writing encrypted state files. This pattern is associated with trojanized
  libraries collecting system information and maintaining encrypted state for C2 communication.
tags:
- attack.discovery
- attack.t1082
- attack.t1027
logsource:
  category: process_creation
  product: macos
detection:
  selection_thread_spawn:
    CommandLine|contains:
    - pthread_create
    - dispatch_async
  selection_lock_file:
    CommandLine|contains:
    - session.lock
    - .lock
  selection_xor_state:
    CommandLine|contains:
    - XOR
    - state
    - encrypted
  condition: selection_thread_spawn and selection_lock_file and selection_xor_state
falsepositives:
- Legitimate multi-threaded applications managing session state
- Development tools and debugging utilities
level: medium
id: 78fdef1d-fa1c-5eac-9d98-3578edde34a5
status: experimental
author: Vorant

macOS Process Beacon to Hardcoded URL with Spoofed Chrome User-Agent

ATT&CK T1071.001

Detects network connections from macOS processes to hardcoded domains using spoofed Chrome/Windows user-agent strings - characteristic of trojanized applications beaconing to C2 infrastructure. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Process Beacon to Hardcoded URL with Spoofed Chrome User-Agent
description: Detects macOS processes initiating HTTP/HTTPS connections with spoofed
  Windows Chrome user-agent strings, typical of trojanized supply-chain compromises
  establishing C2 communication while masquerading as legitimate browsers.
tags:
- attack.command-and-control
- attack.t1071.001
- attack.t1195.002
logsource:
  category: network_connection
  product: macos
detection:
  selection:
    DestinationPort:
    - 80
    - 443
    http_user_agent|contains:
    - Windows
    - Chrome
    Image|endswith:
    - libffmpeg.dylib
    - UpdateAgent
  filter_legitimate:
    Image|contains:
    - Safari
    - Chrome
    - Firefox
  condition: selection and not filter_legitimate
falsepositives:
- Legitimate user-agent spoofing by VPN or proxy software
- Corporate proxy tools modifying user-agent strings
level: high
id: 97078f39-f00c-5736-be24-5d073a518be0
status: experimental
author: Vorant

macOS Trojanized Library Executing Second-Stage Payload via chmod and popen

ATT&CK T1105

Detects libffmpeg.dylib or similar bundled libraries spawning child processes executing chmod followed by popen to launch UpdateAgent - indicative of trojanized library delivering and executing second-stage malware. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: macOS Trojanized Library Executing Second-Stage Payload via chmod and popen
description: Detects bundled/embedded dynamic libraries (libffmpeg.dylib) spawning
  chmod and popen to download, make executable, and launch second-stage payloads (UpdateAgent).
  This is characteristic of trojanized supply-chain compromises delivering staged
  malware.
tags:
- attack.execution
- attack.t1105
- attack.t1195.002
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith: libffmpeg.dylib
  selection_chmod:
    Image|endswith: chmod
    CommandLine|contains:
    - +x
    - '755'
  selection_popen:
    CommandLine|contains:
    - UpdateAgent
    - popen
  condition: selection_parent and (selection_chmod or selection_popen)
falsepositives:
- Legitimate plugin systems extracting and executing libraries from bundles
- Development and testing frameworks
level: high
id: d5f7c396-8a6e-5a61-b677-1d49d8a492fb
status: experimental
author: Vorant

1 more detection artefacts for this report (IOC-atomic rules, Splunk/KQL/Elastic conversions, YARA, Suricata) are available to subscribers.

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://objective-see.org/blog/blog_0x73.html

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free