ICONICSTEALER is a 64-bit Windows information-stealing DLL identified in the supply-chain compromise of the commercial 3CXDesktopApp software. The malicious DLL was bundled inside a 3CXDesktopApp installer and targeted sensitive information stored by multiple web browsers. Analysis showed it searching browser folders for database files and attempting to access the application's config.json file. Its primary role was collection rather than transmission: no exfiltration capability was identified within the DLL, indicating that a separate malicious component was responsible for removing the gathered browser data from the victim system.