20260805-thehackernews.com-ce705 | Perceptive Security

< Back to index

QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

Published:

5 August 2026 at 05:47:19

Alert date:

5 August 2026 at 07:01:24

Source:

thehackernews.com

Supply Chain & Dependencies, Ransomware & Malware, Data Breach & Exfiltration

Cybersecurity researchers from Fortinet FortiGuard Labs have uncovered a long-standing supply chain attack targeting QuickFox, a VPN and network acceleration tool popular among overseas Chinese users. The attack has been ongoing since at least August 2025 and involves a trojanized Windows installer of the QuickFox application. The malicious installer delivers a backdoor named FDMTP onto victim systems. The campaign specifically targets overseas Chinese users who rely on QuickFox to access content restricted in China. Supply chain attacks of this nature are considered high-severity as they compromise legitimate software distribution channels. The use of a trojanized installer makes detection difficult for end users. Fortinet's FortiGuard Labs is credited with the discovery and disclosure of this campaign.

Technical details

A long-standing supply chain attack on QuickFox (a VPN/network acceleration tool for overseas Chinese users) has been ongoing since at least August 2025. Attackers introduced two malicious lines of JavaScript into a modified Electron renderer HTML file within the Windows installer. This causes execution of two JavaScript payloads — 'firebase-app-compat.js' (heavily obfuscated, mimics Firebase SDK) and 'firebase-analytics-compat.js' (legitimate Google Firebase code) — staged on the malicious domain 'cdns3.51quickfox[.]cn', which masquerades as the official QuickFox domain. The obfuscated payload fingerprints the victim endpoint: checks if the OS is Windows, contacts a C2 server to avoid re-infection, runs 'tasklist' to enumerate running processes, aborts if Steam ('steam.exe') is detected, and proceeds only if at least one of 26 targeted applications is found (including Xshell, MobaXterm, Tabby Terminal, Navicat, DBeaver, Git, IntelliJ IDEA, Sublime Text, Notepad++, VS Code, Exodus Wallet, Binance, Ledger Live, Trezor Suite, Telegram, SafeW, Ai Fanyi, Haiwang Chuhai, Yi Fanyi, Kuai Fanyi, HaiYiTong). If conditions are met, a ZIP archive is downloaded from the same domain. Two payload generations exist: Generation 1 (from at least September 2025) uses DLL side-loading to launch a malicious DLL ('Client.dll') embedding FDMTP; Generation 2 (from May 2026) uses DLL side-loading to launch a loader DLL for an encrypted file ('update.bin') containing FDMTP. FDMTP connects to a C2 server, responds to a 'GetInfo' request collecting: active window title, installed antivirus programs, .NET Framework version, network/OS info, username, and implant details (file path, version, process ID, hosting process name). The C2 then requests a process list for further target filtering. FDMTP supports plugin loading for expanded functionality including scheduled task management, Registry persistence, and remote file/command fetching. Tactical overlaps with Mustang Panda (Chinese nation-state actor) are noted, particularly DLL side-loading techniques. The campaign targets Windows users only and likely focuses on Chinese nationals residing abroad or professionals interacting with Chinese speakers.

Mitigation steps:

1. Update QuickFox Windows installer to version 3.59.6 or later, which removes the malicious components. 2. If QuickFox versions 3.0.51.0 through pre-3.59.6 were installed between July 25 and August 13, 2025 (or earlier based on attack onset in August 2025), treat the endpoint as potentially compromised. 3. Block or monitor network traffic to 'cdns3.51quickfox[.]cn' at the perimeter/DNS level. 4. Hunt for presence of 'Client.dll', 'update.bin', 'firebase-app-compat.js', and 'firebase-analytics-compat.js' on Windows endpoints. 5. Monitor for FDMTP-related C2 communication patterns and anomalous use of 'tasklist' commands. 6. Check for DLL side-loading activity and suspicious scheduled tasks or Registry persistence entries. 7. Review endpoints running the targeted applications (Xshell, MobaXterm, Navicat, cryptocurrency wallets, developer tools) for signs of compromise. 8. Monitor for unusual data exfiltration including system info, process lists, antivirus details, and user information. 9. Consider threat hunting for Mustang Panda TTPs, particularly DLL side-loading techniques. 10. Consult Fortinet FortiGuard Labs and Darktrace reports for additional indicators and plugin payloads.

Affected products:

QuickFox VPN/Network Acceleration Tool for Windows (versions 3.0.51.0 through pre-3.59.6; affected between July 25 and August 13
2025 at minimum)