Check Point described the 3CXDesktopApp incident as a supply-chain attack in which a trojanized version of the VoIP desktop client was downloaded by victims and executed a malicious DLL through normal application loading. The infection chain uses DLL side-loading: the signed MSI loads modified ffmpeg.dll, which reads encrypted data from d3dcompiler_47.dll, decrypts it with an embedded RC4 key, and executes code that contacts the IconStorages GitHub archive. The GitHub-hosted icon files contain Base64 data that decrypts into URLs used to download and execute a final payload after a one-week delay. The source lists representative C2 and protection indicators such as msstorageboxes[.]com, azureonlinestorage[.]com, pbxcloudeservices[.]com, and github.com/IconStorages/images.