Zero-day flaw exploited in TrueConf software updates

A zero-day vulnerability in TrueConf's update mechanism was exploited to deliver malware to government entities in Southeast Asia, likely by a Chinese threat actor.

TrueConf Zero-Day Exploited for Malware

China-linked attackers exploited CVE-2026-3502 zero-day vulnerability in TrueConf videoconferencing client to distribute malware within Southeast Asian government networks through compromised update mechanism.

TrueConf Zero-Day Exploited by China-Nexus Attackers

Check Point discovered CVE-2026-3502, a zero-day vulnerability in TrueConf videoconferencing client, exploited by suspected China-nexus attackers to distribute malware within Southeast Asian government networks through malicious client updates.