Trojanized QuickFox installer planted FDMTP on selected Windows systems
Fortinet FortiGuard Labs has disclosed a supply-chain attack involving QuickFox, a VPN and network acceleration application for overseas Chinese users. Active since at least August 2025, the campaign used a modified Windows installer to deliver the FDMTP backdoor. QuickFox removed the malicious components in version 3.59.6; version 3.0.51.0 is the earliest release known to be affected.
The compromise altered an Electron renderer HTML file by adding two lines of JavaScript. Those lines executed payloads named firebase-app-compat.js and firebase-analytics-compat.js from cdns3.51quickfox[.]cn, a domain designed to resemble QuickFox’s official 51quickfox[.]com address. The second file contained legitimate Google Firebase code, while the first mimicked the Firebase SDK and concealed an obfuscated loader.
How the loader selected endpoints
The loader first confirmed that the endpoint ran Windows and contacted command-and-control infrastructure to avoid reinfection. It then executed tasklist to enumerate processes. Execution stopped if steam.exe was present, but continued only when at least one process matched a list of 26 domestic applications, cryptocurrency wallets, developer tools, or enterprise programs.
Products on that list included Xshell, MobaXterm, Navicat, DBeaver, Git, IntelliJ IDEA, Microsoft Visual Studio Code, Exodus Wallet, Binance, Ledger Live, Trezor Suite, Telegram, and several translation applications. Matching systems received a ZIP archive from the same lookalike domain.
The campaign illustrates trusted software as a route into supply chains because a familiar installer and Firebase-like filenames helped malicious code blend into a legitimate software workflow.
Two delivery generations and FDMTP capabilities
Fortinet identified two ZIP payload generations. The first, available from at least September 2025, used DLL side-loading to launch Client.dll, which embedded FDMTP. The second, available from May 2026, side-loaded a malicious DLL that decrypted update.bin, containing the same implant.
After connecting to its command-and-control server, FDMTP answered a GetInfo request with the active window title, installed antivirus products, .NET Framework version, network and operating-system data, username, and implant details. The server could request another process list for further filtering and send plugins that expanded the backdoor’s functions. Darktrace documented plugins for scheduled-task management, Registry persistence, and remote retrieval of files or commands.
Attribution remains unconfirmed
Fortinet did not attribute the operation to a specific group, although it noted tactical overlap with Mustang Panda, including the use of DLL side-loading. Trend Micro first described FDMTP in September 2024 as a secondary tool distributed through PUBLOAD.
Researchers suggested two possible target profiles: Chinese students and expatriates outside China, reflecting QuickFox’s main user base, or professionals interacting with Chinese speakers for trade or diplomatic work. Fortinet said neither hypothesis could be confirmed without victim context from second-stage intrusions.
Business response
Organizations should confirm that Windows endpoints use QuickFox 3.59.6 or later, identify systems that ran releases from 3.0.51.0 onward, and investigate those hosts for follow-on activity. DNS records for the lookalike domain, unusual Electron JavaScript execution, DLL side-loading, downloaded ZIP files, and FDMTP-related process or command-and-control behavior provide practical starting points. The central business implication is that trusted application updates require endpoint and network verification, not automatic acceptance based solely on the software vendor’s identity.