NewsCompaniesFlawsGuides
Get the app
HighFixedBeing used in attacksClosedUpdated

TrueConf Client update flaw CVE-2026-3502 used against government organisations; fix available

Attackers used tampered TrueConf updates to infect Windows computers in Southeast Asian government organisations. Versions 8.1.0–8.5.2 are affected. Install 8.5.3.884 or later from TrueConf, and ask IT to check for compromise.

What to do

If you use TrueConf on Windows, install version 8.5.3.884 or later from TrueConf’s official website, or ask your IT team to do it. If your organisation used an affected version, ask IT to check its TrueConf server and connected computers for signs of compromise.

Check your devices
  • TrueConffixed in 8.5.3.884 and later

What’s happening

TrueConf Client’s Windows updater could run downloaded software without adequately checking its authenticity. Attackers who controlled an organisation’s TrueConf server used this weakness to send malicious updates to connected computers. Check Point observed the TrueChaos campaign at the beginning of 2026 against government organisations in Southeast Asia; one compromised server supplied dozens of government entities. It attributed the activity to a China-linked actor with moderate confidence. TrueConf identifies versions 8.1.0–8.5.2 as affected and 8.5.3.884 or later as fixed. The fix was released in March, before CISA listed the flaw as exploited on 2 April. As of 3 November, a fix is available, but the reviewed sources do not establish whether the campaign has ended or all affected organisations have removed the malware.

What
Flaw
Affects
TrueConf Client for Windows
Affected
TrueConf Client for Windows 8.1.0–8.5.2
Fixed in
TrueConf Client for Windows 8.5.3.884 or later
CVE
CVE-2026-3502
Since
2 Apr 2026
Closed
11 June 2026

Timeline

  1. Update

    TrueConf published its security reference page. It lists versions 8.1.0–8.5.2 as affected and identifies 8.5.3.884 or later as the resolution.

  2. CISA added

    CISA added CVE-2026-3502 to its Known Exploited Vulnerabilities catalogue, requiring US federal civilian agencies to address it by 16 April.

  3. New fixFixed

    Check Point disclosed TrueChaos, attacks it observed at the beginning of 2026 against Southeast Asian government organisations. It reported that TrueConf had released a Windows client fix in version 8.5.3 during March.

  4. Made public

    The CVE record was published for CVE-2026-3502, affecting TrueConf Client versions 8.1.0 through 8.5.2.

Sources

  1. TrueConf Security Vulnerabilities, Fixes and AdvisoriesTrueConf · 11 June 2026
  2. TrueConf 8.5 for desktops OS: new interface, AI, and advanced messengerTrueConf · 14 Aug 2025
  3. TrueConf 8 for WindowsTrueConf
  4. CVE-2026-3502CVE · 30 Mar 2026
  5. Operation TrueChaos: 0-Day Exploitation Against Southeast Asian Government TargetsCheck Point Research · 31 Mar 2026
  6. TrueConf Zero-Day Exploited in Asian Government AttacksSecurityWeek · 3 Apr 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from April 2026 · JSON · RSS