efa4acaa-9c57-4e54-8e1e-5c1186bda686

The 3CX Supply Chain Attack: When Trusted Software Turns Malicious

The support ticket came in hot: "You demolished my call center. We couldn't make or receive a single customer call for a day now. Your XDR agent is blocking the application."

Welcome to March 2023, when Cortex XDR's AI autonomously stopped the now-infamous 3CX supply chain attack—days before the security community had any idea what was happening.

In the debut episode of our new video series “Threat Vector Investigates”, David Szabo, director Cortex Excitement, and Aviel Tzarfaty, Sr. product manager walk through the entire attack—from initial compromise to autonomous prevention—explaining exactly how Cortex XDR's behavioral threat prevention works when supply chain attacks exploit trust.

What You'll See in the Video

The video gets into the technical details that matter for security teams evaluating XDR platforms or trying to understand how behavioral threat analytics actually work in production:

  • How two replaced DLLs in a daily build became a backdoor into 12 million endpoints
  • Why this dormant malware bypassed standard security controls
  • The specific AI technique that caught what signature-based tools missed
  • How autonomous decision-making works at the endpoint—no cloud required
  • Why behavioral detection doesn't care if software is signed or trusted
  • The painful reality of false positives when AI blocks call centers
  • What "trust but validate" actually means in practice

See how Cortex XDR detected a zero-day supply chain attack days before the rest of the cybersecurity industry even knew it existed.


By requesting this resource you agree to our terms of use. All data is protected by our Privacy Notice.

By submitting this form, you are confirming you are an adult of 18 years or older and you agree to Palo Alto Networks contacting you with marketing-related emails or by telephone. You may unsubscribe at any time. Palo Alto Networks websites and communications are subject to their Privacy Notice and Terms of Use