# Lazarus trojanizes 3CX macOS app via libffmpeg.dylib

Published: 2023-03-29 · Severity: critical · Sectors: telecommunications
Canonical: https://vorant.io/reports/3b38e922-fd0e-5778-8062-8eeff9a465ef/lazarus-trojanizes-3cx-macos-app-via-libffmpeg-dylib

> Researchers confirmed the 3CX supply chain attack also trojanized the macOS desktop app, hiding a downloader inside a notarized libffmpeg.dylib library.

Following CrowdStrike's disclosure of a supply chain compromise of the 3CX VOIP desktop client, Objective-See conducted independent analysis to confirm what other vendors could not: that the macOS version of 3CXDesktopApp was indeed trojanized. The malicious code was found embedded in libffmpeg.dylib, a Mach-O universal binary bundled inside the legitimate, Apple-notarized application. Despite passing Apple's notarization checks and being undetected by all AV engines on VirusTotal at time of analysis, the library contained XOR-obfuscated strings, anti-debugging timing checks, and dynamically resolved APIs designed to frustrate analysis.

Dynamic analysis via lldb revealed the malware spawns a thread that builds a session-lock file path, collects host information (OS version, hostname), generates a UUID, and writes an XOR-encrypted state file. It then constructs and beacons to a hardcoded C2 URL (pbxsources.com/queue) using a spoofed Windows Chrome user-agent, expecting an HTTP 200 response before downloading and executing a second-stage payload named UpdateAgent via chmod and popen. At the time of analysis the C2 domain was already sinkholed/offline (NXDOMAIN), preventing full second-stage retrieval, though the embedded domain list matches infrastructure previously seen in the Windows variant of the same campaign.

Apple has since revoked the code-signing certificate used to notarize the trojanized application, rescinding its notarization status. The activity has been publicly attributed by CrowdStrike to the Lazarus Group, targeting an application used by roughly 600,000 companies and 12 million users worldwide, making this a significant and ongoing supply chain threat with both Windows and macOS components sharing common C2 infrastructure.

## Mentioned in this report

- Threat actors: Lazarus Group
- Malware: SmoothOperator, UpdateAgent, libffmpeg.dylib
- Campaigns: 3CX Supply Chain Attack, SmoothOperator

Source reporting: https://objective-see.org/blog/blog_0x73.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/3b38e922-fd0e-5778-8062-8eeff9a465ef/lazarus-trojanizes-3cx-macos-app-via-libffmpeg-dylib.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup