Trojanized QuickFox Installer Delivered the FDMTP Backdoor

Fortinet's FortiGuard Labs has reported a long-running supply-chain attack on QuickFox — a VPN service and network-acceleration tool aimed at Chinese nationals living abroad. According to the researchers, the campaign has been active since at least August 2025: the attackers distributed a trojanized version of the app that installed the FDMTP backdoor, previously used by the Chinese state-sponsored group Mustang Panda.

How the infected installer worked

The malicious code amounted to two lines of JavaScript in a single HTML file of the Electron application. They pulled in two scripts from the domain cdns3.51quickfox[.]cn, which masqueraded as the service's official website. One of the scripts contained legitimate Google Firebase code, while the second only imitated the Firebase SDK and in fact inspected the victim's system.

The loader made sure it was dealing with Windows, checked in with a command-and-control server to avoid reinfecting a machine, and ran the tasklist command to obtain a list of processes. If Steam was among them, execution was aborted. On the other hand, the presence of at least one of 26 applications — among them Xshell, MobaXterm, Navicat, DBeaver, Git, IntelliJ IDEA, VS Code, Notepad++, as well as the crypto wallets Exodus, Binance, Ledger Live, Trezor Suite, the Telegram messenger and a number of Chinese translation tools — signaled that the target was of interest.

Two versions of the payload

When the conditions matched, the script downloaded a ZIP archive. Two generations were found: the earlier one (from September 2025) used DLL sideloading to launch a malicious library, Client.dll, carrying FDMTP, while a newer one (from May 2026) used the same technique to launch a loader for the encrypted file update.bin.

FDMTP itself, first described by Trend Micro in 2024, establishes a connection with the server and transmits data about the victim: the title of the active window, installed antivirus products, the .NET version, and information about the network, the OS and the current user. It can then pull in plugins that extend its functionality — from managing scheduled tasks and registry persistence to remotely downloading files and running commands.

Who is in the crosshairs

QuickFox removed the malicious components in version 3.59.6; builds from 3.0.51.0 onward turned out to be infected, and the attack affected only Windows users. Fortinet stopped short of directly attributing the campaign, but noted tactical overlaps with Mustang Panda, which is known for its fondness for DLL sideloading.

Since QuickFox's main audience is Chinese students and emigrants, the researchers assume the target was Chinese citizens abroad. An alternative hypothesis is that the attack was aimed at professionals who have to communicate with Chinese speakers — for example, in the interests of trade or diplomacy. Neither version can be confirmed for now.

Source: The Hacker News