Hacked calls - how?

[ngingras (Nathan Gingras)]

That is a variant of this classic:

I’ve been hacked! Macro [thanku-outcall]; thankuohoh

People, Checking the dialplan and came across the following context below: [thanku-outcall]; thankuohoh exten => _.,1,Macro(user-callerid,LIMIT,EXTERNAL,); thankuohoh exten => _.,n,Set(MOHCLASS=${IF($["${MOHCLASS}"=""]?default:${MOHCLASS})}); thankuohoh exten => _.,n,Set(_NODEST=); thankuohoh exten => _.,n,Macro(dialout-trunk,2,${EXTEN},on); thankuohoh exten => _.,n,Macro(outisbusy,); thankuohoh

Usually occurs due to some outdated module, etc.

Recommend deleting that and carrying on with the items I recommended in a previous post on this thread. (alternatively, wipe and start fresh or restore from a known clean backup)