QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
Researchers disclosed a long-running supply chain attack on QuickFox VPN that used a trojanized Windows installer to deliver the FDMTP backdoor, with tactical overlaps pointing to the Chinese state-sponsored group Mustang Panda.
Intelligence analysis by Llama
Fortinet FortiGuard Labs documented a supply chain attack on QuickFox, a VPN popular with overseas Chinese users, in which a modified Electron renderer in the Windows installer fingerprints victims before loading the FDMTP backdoor linked to Mustang Panda.
Hackers sneaked bad code into a free VPN app that lots of Chinese students and travelers use to watch videos from home. The bad code peeked at what programs were on the computer and only let the hackers inside if it found something interesting. The sneaky part lasted almost a year before anyone noticed.
Analysis
Two Lines of Code, One Quiet Compromise
The elegance of the QuickFox intrusion lies in its minimalism. According to Fortinet FortiGuard Labs, the attackers introduced just two lines of JavaScript into a single HTML file inside a modified Electron renderer. That tiny insertion caused the installer to fetch and execute two payloads from cdns3.51quickfox[.]cn, a domain that closely mimics the legitimate 51quickfox[.]com. One payload, named firebase-analytics-compat.js, contains unmodified Google Firebase code, lending the activity an air of normalcy. The other, firebase-app-compat.js, masquerades as a Firebase SDK while in reality fingerprinting the victim and orchestrating the next stage.
This approach demonstrates a sophisticated understanding of how defenders triage alerts. By piggybacking on a familiar JavaScript library and using a typosquatting C2, the operators aimed to slip past both human review and automated scanners. The malicious installer circulated for nearly a year before QuickFox purged the bad components in version 3.59.6, with the cleanup landing between July 25 and August 13, 2025, and 3.0.51.0 marking the earliest affected build.
FDMTP: A Backdoor With Curated Targets
Unlike commodity malware that casts a wide net, FDMTP applies a strict filtering routine before progressing. The loader first checks for Steam (steam.exe) and aborts if present, presumably to avoid gaming rigs, sandbox environments, or unintended victims. It then requires at least one process to match a curated list of 26 applications spanning developer tools (VS Code, IntelliJ IDEA, Git, Sublime Text), SSH clients (Xshell, MobaXterm, Tabby), database utilities (Navicat, DBeaver), crypto wallets (Exodus, Binance, Ledger Live, Trezor Suite), messaging apps (Telegram, SafeW), and a cluster of Chinese-language tools.
Two generations of the ZIP payload have surfaced. Generation 1, available from at least September 2025, uses DLL side-loading to launch a malicious DLL that embeds FDMTP directly. Generation 2, observed from May 2026, uses DLL side-loading to launch a loader that decrypts an update.bin archive containing FDMTP. Once resident, the implant collects an unusually rich profile of the host, including the topmost active window title, installed antivirus products, .NET runtime version, OS and network details, username, and implant metadata, before fetching additional plugins from the C2 for tasks such as scheduled-task management and registry persistence.
Pointing Fingers Without Naming Names
Fortinet stopped short of a hard attribution but flagged clear tactical overlap with Mustang Panda, a Chinese state-sponsored actor long associated with DLL side-loading tradecraft. The connection is reinforced by Trend Micro's September 2024 write-up, which first named FDMTP as a secondary payload of the PUBLOAD downloader. QuickFox's user base, primarily Chinese international students and expats, makes the tool a natural intelligence vector, though Fortinet floated an alternative hypothesis: that the campaign could have aimed at Western professionals required to interact with Chinese speakers for trade or diplomatic purposes. Without visibility into second-stage victimology, the true target set remains a matter of informed conjecture rather than confirmed fact.
Key points
- QuickFox's Windows installer was trojanized since at least August 2025; the vendor removed the malicious code in version 3.59.6 between July 25 and August 13, 2025, with 3.0.51.0 the earliest affected build.
- The attack targeted only Windows users via a modified Electron renderer that loaded two JavaScript payloads, including a Firebase look-alike, from a typosquatting C2 domain.
- The loader fingerprints victims by aborting on Steam and requiring at least one of 26 developer tools, crypto wallets, SSH clients, database utilities, and Chinese-language apps to be running.
- Two FDMTP generations (first publicly tied to Mustang Panda via Trend Micro's 2024 PUBLOAD coverage) have been observed, both relying on DLL side-loading, with the second added in May 2026.
- Fortinet declined a formal attribution but cited tactical overlap with Mustang Panda and noted two competing hypotheses about the intended victim set: overseas Chinese users or Western professionals engaging with Chinese speakers.
QuickFox moved quickly to remove the malicious components once Fortinet disclosed the issue, and the public write-up ships with concrete IoCs such as the cdns3.51quickfox[.]cn domain, the firebase-app-compat.js filename, and detailed FDMTP TTPs that defenders across the industry can hunt for. Broader awareness of Mustang Panda's preference for DLL side-loading in trojanized installers raises the operational cost of repeating the same playbook elsewhere.
A campaign that lived in an actively distributed installer for nearly a year implies a meaningful number of endpoints may already harbor persistence mechanisms outside the scope of Fortinet's disclosure. Mustang Panda's history of long-dwell intrusions, paired with FDMTP's plugin-loading architecture, means compromised hosts could quietly remain useful to the operator long after the trojanized installer is cleaned up.
