A group of cybersecurity researchers has disclosed a long-running supply chain incident affecting QuickFox, a VPN and network acceleration tool aimed at overseas Chinese users. According to Fortinet FortiGuard Labs, the compromise involved a trojanized Windows installer that ultimately delivered a backdoor dubbed FDMTP. The issue was addressed after responsible disclosure, when QuickFox released an updated Windows installer that removed the malicious components.
In this article, we break down what was found: how the trojanized installer worked, what the FDMTP backdoor did after deployment, and what changes were later introduced to protect users on Windows.
What Fortinet reports about the QuickFox supply chain backdoor
Fortinet states that the supply chain attack has been active since at least August 2025. The core mechanism was not a typical “download malware from a website” scenario, but rather an infected application package. In other words, the harmful code was introduced directly into the installation process of QuickFox on Windows.
Fortinet’s Incident Response Team describes the delivery as a modified Electron renderer HTML file. That file’s job was to download and execute a JavaScript-based loader. When the loader runs, it performs endpoint fingerprinting to check whether the system matches a likely target before installing the backdoor implant.
How the trojanized installer executed the payloads
The malicious changes were present in certain Windows installer versions. QuickFox later removed the components with version 3.59.6. Fortinet indicates that the modifications were included sometime between July 25 and August 13, 2025, and that the earliest affected version was 3.0.51.0.
Within the installer executable, the introduced code consisted of two lines of JavaScript inside a single HTML file. Once executed, the installer triggered two JavaScript payloads staged on a domain that was designed to look legitimate at first glance: cdns3.51quickfox[.]cn. Fortinet highlights that the attackers used a domain impersonation trick by masquerading as what appears to be the QuickFox domain (51quickfox[.]com) to reduce the chance of detection.
The two payloads were:
- firebase-app-compat.js — heavily obfuscated and malicious
- firebase-analytics-compat.js — included legitimate Google Firebase code
The inclusion of a legitimate-looking Firebase component appears aimed at making the overall behavior less suspicious, while the obfuscated script performed the real malicious checks and staging.
Fingerprinting, C2 checks, and process-based targeting
After the installer’s JavaScript payloads ran, the malicious firebase-app-compat.js performed multiple steps to determine whether to proceed. Fortinet reports that it included logic to:
- verify whether the affected endpoint runs Windows
- check communication with a command-and-control (C2) server
- avoid re-infection by confirming the endpoint’s status with the C2
- execute the tasklist command to retrieve currently running process names
Next, it applied process filtering. It explicitly aborted execution if it detected the presence of Steam (steam.exe). In addition, it looked for at least one process name matching a list of 26 “domestic” applications and software commonly associated with specific user profiles and workflows.
Fortinet lists examples from this set, including tools and products such as:
- remote access and terminal tools (e.g., Xshell, MobaXterm, Tabby Terminal)
- database and development software (e.g., Navicat, DBeaver, Git, IntelliJ IDEA, Sublime Text)
- editors and coding environments (e.g., Notepad++, Microsoft Visual Studio Code)
- cryptocurrency wallets and exchange-related apps (e.g., Exodus Wallet, Binance, Ledger Live, Trezor Suite)
- messaging (e.g., Telegram)
- other enterprise and language-related applications (e.g., several translation and business tools mentioned by Fortinet)
If the required conditions were not met, the script would stop, reducing the chance of deploying the backdoor on systems that did not match the campaign’s intended target profile.
Downloading the next stage: two generations of ZIP payloads
When the conditions aligned, the script downloaded a second-stage package. Fortinet reports that the next payload was a ZIP archive retrieved from the same infrastructure used earlier (cdns3.51quickfox[.]cn). Two different generations of that ZIP payload were observed.
Generation 1, available from at least September 2025, used DLL side-loading. In this version, the attackers launched a malicious DLL carrying FDMTP, referenced as Client.dll.
Generation 2, identified from May 2026, also relied on DLL side-loading. However, this time it launched a malicious DLL that acted as a loader for an encrypted file named update.bin, which contained FDMTP.
Fortinet’s analysis also connects this backdoor family to earlier reporting: Trend Micro highlighted FDMTP in September 2024 as a secondary tool delivered via a downloader known as PUBLOAD.
What FDMTP does after installation
Fortinet describes FDMTP’s behavior as iterative and operator-driven. In one early phase, the implant attempts to obtain a connection to its C2 server. Once it establishes communication, the server sends a GetInfo request to collect basic information from the victim device.
The data collected includes details such as:
- the title of the topmost active window
- installed antivirus programs
- .NET Framework runtime version
- network and operating system information
- the current username
- metadata about the implant itself (including file path, version, process ID, and hosting process name)
After packaging and exfiltrating that information, the C2 server asks the implant to list running processes again. Fortinet explains that this is part of how the operators further filter endpoints in support of their broader goals.
Another capability highlighted by researchers is plugin loading. The malware can load plugins received from the C2 server, allowing operators to extend its functionality.
Some of the observed payloads, as summarized by Darktrace earlier in the year, supported activities like managing scheduled tasks, setting persistence through Windows Registry modifications, and remotely fetching files or commands.
Threat actor context and targeting hypotheses
Fortinet does not attribute the campaign to a specific named threat actor. Still, it acknowledges tactical overlaps with Mustang Panda, a Chinese nation-state-linked adversary known for using DLL side-loading techniques as part of malware deployment.
Because QuickFox’s primary audience is Chinese international students and expats, Fortinet states that one working theory is that the campaign may have focused on Chinese citizens outside China. Another hypothesis suggests targeting professionals who interact with Chinese native speakers, potentially for commercial or diplomatic engagement.
Fortinet also notes that neither hypothesis can be confirmed without deeper insight into second-stage intrusions, which would reveal more about the true end victims.
What changed after disclosure: QuickFox removed the malicious components
Following responsible disclosure, QuickFox removed the malicious elements from its Windows installer. Fortinet emphasizes that the campaign evidence indicates it targeted Windows users only.
For users, the takeaway is straightforward: installing the latest 3.59.6 or newer Windows version is the mitigation step recommended by the vendor timeline described in Fortinet’s report.
Organizations and individuals should also consider verifying endpoint security posture—especially on systems that may have installed earlier QuickFox versions during the affected period. While this disclosure focuses on the supply chain compromise, the long-term risk can depend on whether a backdoor stage ultimately executed and maintained access.
Conclusion
The QuickFox supply chain backdoor case illustrates how attackers can compromise software distribution rather than attacking victims directly. Fortinet’s findings describe a trojanized Windows installer that delivered FDMTP through staged JavaScript, used process-based checks to decide whether to proceed, and then leveraged DLL side-loading techniques for the final payload. QuickFox later removed the malicious components in Windows installer version 3.59.6, but the incident underscores the importance of timely updates and careful endpoint monitoring.
Source: https://thehackernews.com/2026/08/quickfox-supply-chain-attack-delivers.html
