QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer --> #1 Trusted Cybersecurity News
Platform Followed by 5.70+ million Get the Latest News Home
Newsletter Webinars Home Threat Intelligence Vulnerabilities Cyber Attacks Webinars Expert Insights Awards
Resources Webinars Awards Free eBooks About Site About THN Jobs Advertise with us Contact/Tip Us
Reach out to get featured—contact us to send your exclusive story idea, research, hacks, or ask us a
question or leave a comment/feedback! Follow Us On Social Media
RSS Feeds Email Alerts QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
Ravie LakshmananAug 05, 2026Supply Chain Attack / Endpoint Security Cybersecurity researchers have
disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network (VPN)
and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply
chain attack has been ongoing since at least August 2025 and involves a trojanized version of the application to deliver
FDMTP, a backdoor that has been put to use by a Chinese state-sponsored threat actor tracked as Mustang Panda. "The
attack is delivered via a modified Electron renderer HTML file used to download and execute a JavaScript-based loader,"
the FortiGuard Incident Response Team said. "Upon execution, the JavaScript loader fingerprints the victim endpoint to
determine if it's a valid target before downloading and installing an FDMTP implant." Following responsible disclosure,
QuickFox has removed the malicious components from their Windows installer with the release of version 3.59.6. The
changes are said to have been included sometime between July 25 and August 13, 2025, with 3.0.51.0 being the earliest
affected version. Evidence indicates that the campaign solely targeted Windows users. The malicious code introduced to
the installer executable involves two lines of JavaScript in a single HTML file, causing it to execute two JavaScript
payloads -- "firebase-app-compat.js" and "firebase-analytics-compat.js" -- staged on "cdns3.51quickfox[.]cn," which
masquerades as the official QuickFox domain ("51quickfox[.]com") to evade detection. Of the two payloads,
"firebase-analytics-compat.js" contains legitimate Google Firebase code, while "firebase-app-compat.js" is a heavily
obfuscated payload that mimics the Firebase SDK, but harbors functionality to ascertain if the affected endpoint is
running Windows, check with a command-and-control (C2) server to ensure the endpoint is not re-infected, and run the
"tasklist" command to obtain a list of currently running processes. This list is then checked for specific process
names, specifically Steam ("steam.exe"), and aborts execution if it is present. It also checks if there exists at least
one process name that matches 26 domestic applications, cryptocurrency wallets, developer tools, and enterprise
software. This includes Xshell, MobaXterm, Tabby Terminal, Navicat, DBeaver, Git, IntelliJ IDEA, Sublime Text,
Notepad++, Microsoft Visual Studio Code, Exodus Wallet, Binance, Ledger Live, Trezor Suite, Telegram, SafeW, Ai Fanyi,
Haiwang Chuhai, Yi Fanyi, Kuai Fanyi, and HaiYiTong. Once both these conditions are met, the script proceeds to download
the next stage payload, a ZIP archive from the same aforementioned domain. Two different generations of the ZIP payload
have been identified - Generation 1 (Available from at least September 2025), which uses DLL side-loading to launch a
malicious DLL embedding FDMTP ("Client.dll") Generation 2 (Available from May 2026), which also uses DLL side-loading to
launch a malicious DLL that acts as a loader for an encrypted file ("update.bin") that contains FDMTP FDMTP was first
highlighted by Trend Micro in September 2024 as a secondary tool distributed via a downloader known as PUBLOAD. In the
latest iteration, it first attempts to obtain a C2 connection, following which the server responds with a "GetInfo"
request to gather basic information from the victim's device. The collected data contains the window title of the
topmost active program, installed antivirus programs, .NET Framework runtime version, network and operating system
information, current username, and details about the implant itself, such as file full path, version, process ID, and
hosting process name. Once this information is packaged and exfiltrated, the C2 server sends a request to list running
processes in a further attempt to filter out certain endpoints in furtherance of the threat actor's goals. Additionally,
the malware is responsible for loading plugins received from the server, allowing the operators to expand its
functionality at will. Some of the payloads, as detailed by Darktrace earlier this year, facilitate the management of
scheduled tasks, oversee Registry persistence, and remotely fetch files or commands. Although Fortinet has not
attributed the campaign to a specific threat actor, it acknowledged tactical overlaps with Mustang Panda, a Chinese
nation-state adversary known for its reliance on DLL side-loading techniques to deploy malware. Given that QuickFox's
primary user base is Chinese international students and expats, it's suspected that the campaign may have singled out
Chinese citizens residing outside China. "A competing hypothesis is that this campaign aimed to target professionals
required to interact with Chinese native speakers, potentially for trade or diplomatic engagement purposes," Fortinet
said. "Neither hypothesis can be confirmed without understanding the victim context for second-stage intrusions, which
would identify true targets of the campaign." Found this article interesting? Follow us on Google News, Twitter and
LinkedIn to read more exclusive content we post. SHARE Tweet Share
Share Share Share on Facebook Share on Twitter Share on Linkedin
Share on Reddit Share on Hacker News Share on Email Share on WhatsApp Share on Facebook
Messenger Share on Telegram SHARE Application Security, Backdoor, endpoint security, Malware, malware
analysis, network security, Supply Chain Attack, Threat Intelligence, VPN Security, Windows Security ⚡ Top Stories
This Week New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit Open-Source Android AI
Agents Could Let Invisible Screen Text Run Code on Host PCs Critical SharePoint RCE CVE-2026-50522 Under Active
Exploitation After Public PoC AWS Kiro Flaw Let a Poisoned Web Page Rewrite Its Config and Run Code Apple Fixes Hide My
Email Bug That Exposed Real Addresses in Mail Logs Microsoft Azure DevOps MCP Flaw Lets Hidden PR Comments Hijack AI
Review Agents OpenAI Says Its AI Models Escaped Sandbox, Targeted Hugging Face to Cheat Benchmark Adobe Acrobat
Extension Flaw Let Malicious Sites Read WhatsApp Web Data Ubuntu snap-confine Flaw Could Give Local Users Root on
Default Desktop Installs Nine-Year-Old RefluXFS Linux Flaw Gives Local Users Root on Default RHEL Installs Attackers
Weaponize GitHub Actions Runners to Target cPanel and WHM Servers Claude Cowork Flaw Could Let AI Agent Escape Its VM
and Access Mac Files ThreatsDay: Android Spyware, PLC Attacks, AI Image Prompt Injection + 12 More Stories Kimi K3
Agents Found Redis Zero-Days and Built RCE Exploit, Researchers Say Hacker Runs Hermes AI Agent Unattended for
Post-Exploitation at Thai Finance Ministry ChatGPT AgentForger Flaw Could Deploy Rogue Workspace Agents via a Phishing
Link Certighost Exploit Lets Low-Privileged Active Directory Users Impersonate a Domain Controller Researcher Publishes
GitLab RCE PoC Letting Authenticated Users Run Commands as Git Fastjson 1.x RCE Vulnerability Targeted in Attacks With
No Patched Available Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable ⭐ Featured
Resources [Webinar] How Militaries Can Trust the Data Behind Autonomous Missions Download the 5-Step Action Plan for
AI-Speed Exploitation Get the Checklist for Gaining Control of AI Use Across Your Organization Get the 2026 CISO
Benchmark Report Based on 600 Security Leaders Cybersecurity Webinars Risk in AI-Generated Code How to Secure AI Code
Before It Reaches Production Learn how 300 enterprise leaders are managing AI-driven open-source risk, remediation debt,
and governance at scale. Register Build AI Securely How to Secure AI-Built Software at Machine Speed Learn how to govern
risk, secure AI-built software, and keep control as development moves at machine speed. Register ⚡ Latest News
Cybersecurity Resources 11 Real Stories: How Identity Exposure Unlocks Active Attack PathsMap cross-domain privilege
escalation to sever breach routes at key choke points. Burp, sqlmap, SSRF, XXE, SSTI: Web Exploitation, Hands-On35 labs
plus a live CTF take you from recon to remote code execution. GWAPT prep, SANS CDI in D.C. SANS AI Cybersecurity Summit
Returns This NovemberLearn how practitioners are applying AI to today's cybersecurity challenges. Expert
Insights Articles Videos How AI-Assisted Attacks Are Breaking Legacy SIEM Tools August 3, 2026 Read ➝ A
Look Inside Lasso's AI Security Platform July 27, 2026 Read ➝ Claude Runs Across Six Surfaces in Your
Company. Your Security Team Sees One. July 27, 2026 Read ➝ How to Make Social Engineering Unprofitable
July 22, 2026 Read ➝ Get the Latest News in Your Inbox Get the latest news, expert insights, exclusive
resources, and strategies from industry leaders, all for free. Email Connect with us! 2,000,000 Followers
725,000 Followers 25,500 Subscribers 172,000 Followers 1,990,000 Followers 60,000
Followers Company About THN Advertise with us Contact Pages Webinars Awards Privacy Policy RSS Feeds
Contact Us © 2026 The Hacker News. All Rights Reserved.