QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

Summary

A long-standing supply chain attack targeting QuickFox VPN users has been disclosed, delivering the FDMTP backdoor via a trojanized Windows installer. The attack, attributed to Chinese state-sponsored threat actor Mustang Panda, began in August 2025 and uses modified Electron renderer files to download and execute JavaScript loaders. The malware checks for specific applications and then downloads the FDMTP implant, with QuickFox releasing a patched version in August 2025.

Full text

QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer Ravie LakshmananAug 05, 2026Supply Chain Attack / Endpoint Security Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing since at least August 2025 and involves a trojanized version of the application to deliver FDMTP, a backdoor that has been put to use by a Chinese state-sponsored threat actor tracked as Mustang Panda. "The attack is delivered via a modified Electron renderer HTML file used to download and execute a JavaScript-based loader," the FortiGuard Incident Response Team said. "Upon execution, the JavaScript loader fingerprints the victim endpoint to determine if it's a valid target before downloading and installing an FDMTP implant." Following responsible disclosure, QuickFox has removed the malicious components from their Windows installer with the release of version 3.59.6. The changes are said to have been included sometime between July 25 and August 13, 2025, with 3.0.51.0 being the earliest affected version. Evidence indicates that the campaign solely targeted Windows users. The malicious code introduced to the installer executable involves two lines of JavaScript in a single HTML file, causing it to execute two JavaScript payloads -- "firebase-app-compat.js" and "firebase-analytics-compat.js" -- staged on "cdns3.51quickfox[.]cn," which masquerades as the official QuickFox domain ("51quickfox[.]com") to evade detection. Of the two payloads, "firebase-analytics-compat.js" contains legitimate Google Firebase code, while "firebase-app-compat.js" is a heavily obfuscated payload that mimics the Firebase SDK, but harbors functionality to ascertain if the affected endpoint is running Windows, check with a command-and-control (C2) server to ensure the endpoint is not re-infected, and run the "tasklist" command to obtain a list of currently running processes. This list is then checked for specific process names, specifically Steam ("steam.exe"), and aborts execution if it is present. It also checks if there exists at least one process name that matches 26 domestic applications, cryptocurrency wallets, developer tools, and enterprise software. This includes Xshell, MobaXterm, Tabby Terminal, Navicat, DBeaver, Git, IntelliJ IDEA, Sublime Text, Notepad++, Microsoft Visual Studio Code, Exodus Wallet, Binance, Ledger Live, Trezor Suite, Telegram, SafeW, Ai Fanyi, Haiwang Chuhai, Yi Fanyi, Kuai Fanyi, and HaiYiTong. Once both these conditions are met, the script proceeds to download the next stage payload, a ZIP archive from the same aforementioned domain. Two different generations of the ZIP payload have been identified - Generation 1 (Available from at least September 2025), which uses DLL side-loading to launch a malicious DLL embedding FDMTP ("Client.dll") Generation 2 (Available from May 2026), which also uses DLL side-loading to launch a malicious DLL that acts as a loader for an encrypted file ("update.bin") that contains FDMTP FDMTP was first highlighted by Trend Micro in September 2024 as a secondary tool distributed via a downloader known as PUBLOAD. In the latest iteration, it first attempts to obtain a C2 connection, following which the server responds with a "GetInfo" request to gather basic information from the victim's device. The collected data contains the window title of the topmost active program, installed antivirus programs, .NET Framework runtime version, network and operating system information, current username, and details about the implant itself, such as file full path, version, process ID, and hosting process name. Once this information is packaged and exfiltrated, the C2 server sends a request to list running processes in a further attempt to filter out certain endpoints in furtherance of the threat actor's goals. Additionally, the malware is responsible for loading plugins received from the server, allowing the operators to expand its functionality at will. Some of the payloads, as detailed by Darktrace earlier this year, facilitate the management of scheduled tasks, oversee Registry persistence, and remotely fetch files or commands. Although Fortinet has not attributed the campaign to a specific threat actor, it acknowledged tactical overlaps with Mustang Panda, a Chinese nation-state adversary known for its reliance on DLL side-loading techniques to deploy malware. Given that QuickFox's primary user base is Chinese international students and expats, it's suspected that the campaign may have singled out Chinese citizens residing outside China. "A competing hypothesis is that this campaign aimed to target professionals required to interact with Chinese native speakers, potentially for trade or diplomatic engagement purposes," Fortinet said. "Neither hypothesis can be confirmed without understanding the victim context for second-stage intrusions, which would identify true targets of the campaign." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Application Security, Backdoor, endpoint security, Malware, malware analysis, network security, Supply Chain Attack, Threat Intelligence, VPN Security, Windows Security ⚡ Top Stories This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3 Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO Benchmark Report Based on 600 Security Leaders

Indicators of Compromise

• domain — cdns3.51quickfox.cn
• domain — 51quickfox.com
• malware — FDMTP
• mitre_attack — T1059.007
• mitre_attack — T1574.002
• mitre_attack — T1071.001

Entities