Here is a good article from Sophos that describes what is going on.
3CX CEO Nick Galea is urging users to uninstall the affected software, which includes versions 18.12.407 and 18.12.416 of the Windows app. The company is working on an update to fully resolve the threat. In the meantime, 3CX says users can use its web-based app as a substitute.
I have moved back to an earlier version of the app in the meantime but we have heard that another update should be available shortly to take care of this issue.