QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
A long-standing supply chain attack on the QuickFox VPN tool has been delivering the FDMTP backdoor since at least August 2025, primarily targeting overseas Chinese users.
Cybersecurity researchers have uncovered a persistent supply chain attack targeting QuickFox, a VPN and network acceleration tool widely used by overseas Chinese individuals. The campaign, active since at least August 2025, involves a trojanized version of the Windows installer designed to deploy the FDMTP backdoor, a tool previously linked to the Chinese state-sponsored threat actor known as Mustang Panda.
The attack vector begins with a modified Electron renderer HTML file within the QuickFox installer. This file is responsible for downloading and executing a JavaScript-based loader. This loader first fingerprints the victim's system to ensure it's a valid target before proceeding to download and install the FDMTP implant. QuickFox has since addressed the vulnerability, removing the malicious components in version 3.59.6, with affected versions dating back to 3.0.51.0.
The malicious code is subtly embedded within a single HTML file, executing two JavaScript payloads: "firebase-app-compat.js" and "firebase-analytics-compat.js." These are hosted on a domain, "cdns3.51quickfox[.]cn," which mimics the legitimate QuickFox domain to evade detection. While "firebase-analytics-compat.js" contains benign Google Firebase code, "firebase-app-compat.js" is heavily obfuscated and contains the core malicious logic.
This obfuscated payload performs several checks before proceeding. It verifies if the endpoint is running Windows, communicates with a command-and-control (C2) server to prevent re-infection, and executes the "tasklist" command to enumerate running processes. Crucially, it aborts execution if specific processes like "steam.exe" are detected, and also checks for the presence of at least one of 26 domestic applications, cryptocurrency wallets, developer tools, and enterprise software, including popular tools like Xshell, MobaXterm, Git, IntelliJ IDEA, and Binance.
Upon successful validation, the script downloads the next stage payload from the same domain. This payload is delivered as a ZIP archive, with two generations identified. The first generation, available since September 2025, uses DLL side-loading to execute a malicious DLL containing the FDMTP backdoor. The second generation, observed from May 2026, also employs DLL side-loading but acts as a loader for an encrypted FDMTP file disguised as "update.bin."
Once established, the FDMTP implant communicates with its C2 server, initiating a "GetInfo" request to collect sensitive system data. This includes the active window title, installed antivirus programs, .NET Framework version, network and OS details, username, and information about the implant itself. This data is then exfiltrated to the C2 server.
Further C2 commands can instruct the malware to list running processes, filter endpoints, and download plugins to extend its functionality. Past analysis of FDMTP payloads has revealed capabilities for managing scheduled tasks, maintaining persistence via the Registry, and remotely fetching files or commands. While Fortinet has not definitively attributed the campaign, tactical similarities align with Mustang Panda's known methods, particularly their reliance on DLL side-loading techniques.
The campaign's focus on overseas Chinese users suggests a potential targeting of Chinese expatriates, students, or professionals interacting with Chinese entities. The exact motives behind the data collection and subsequent intrusions remain under investigation, pending further analysis of second-stage activities.