Cybersecurity researchers have uncovered a long-running supply chain attack that compromised QuickFox, a VPN and network acceleration application widely used by Chinese citizens living overseas.
According to researchers at Fortinet FortiGuard Labs, attackers secretly modified the Windows installer for QuickFox to distribute a sophisticated backdoor known as FDMTP, malware previously associated with the Chinese state-linked threat group Mustang Panda.
The campaign is believed to have been active since at least August 2025.
Malicious Code Hidden Inside the Installer
Rather than exploiting users after installation, attackers inserted malicious code directly into the application’s installer.
Researchers found that a modified Electron HTML file inside the installer executed hidden JavaScript code that silently contacted attacker-controlled infrastructure.
The malicious script first evaluated the victim’s computer before deciding whether to continue the infection process.
Only systems matching the attackers’ selection criteria received the next-stage malware.
QuickFox Releases Security Update
Following responsible disclosure from researchers, QuickFox removed the malicious components from its Windows installer.
The company addressed the issue beginning with version 3.59.6.
Investigators believe affected versions date back to at least 3.0.51.0, indicating that compromised installers may have been distributed for nearly a year before the issue was discovered.
Current evidence suggests the attack targeted Windows users only.
Fake Domain Used to Evade Detection
The attackers relied on a lookalike domain designed to resemble QuickFox’s official website.
During installation, the modified application downloaded two JavaScript files from the attacker-controlled server.
One file contained legitimate Google Firebase code, helping the activity appear normal, while the second file was heavily obfuscated and performed the malicious operations.
By mixing legitimate and malicious code, the attackers reduced the likelihood of triggering security alerts.
Malware Carefully Selected Its Victims
Before deploying the backdoor, the malicious script gathered information about the infected computer.
It confirmed the operating system was Windows and checked whether the system had already been infected.
The malware also examined running processes to determine whether the device belonged to a user of interest.
Researchers discovered that the malware searched for dozens of applications commonly used by developers, system administrators, cryptocurrency users, and business professionals.
Among the targeted software were:
- Visual Studio Code
- Git
- IntelliJ IDEA
- Notepad++
- Navicat
- DBeaver
- Xshell
- MobaXterm
- Telegram
- Exodus Wallet
- Ledger Live
- Binance
- Trezor Suite
Interestingly, the malware stopped execution if it detected Steam, suggesting the attackers deliberately avoided infecting gaming systems.
Two Versions of the Malware Payload
Researchers identified two different generations of the malicious payload.
The earlier version, observed in 2025, used DLL side-loading to launch the FDMTP backdoor directly.
A newer version, introduced during 2026, added another layer of stealth by loading an encrypted file containing the malware after the DLL was executed.
Both variants ultimately installed the same backdoor on selected systems.
What FDMTP Does
Once installed, FDMTP establishes communication with a remote command-and-control server.
The malware collects extensive information from the compromised computer, including:
- Operating system details
- Network configuration
- Current username
- Installed antivirus software
- Active application window
- .NET Framework version
- Running processes
- Information about the malware itself
This data helps attackers determine whether the infected device is valuable enough for further exploitation.
Modular Design Expands Capabilities
Researchers found that FDMTP supports additional plugins delivered by its command server.
These plugins allow attackers to expand the malware’s functionality after deployment.
Previously documented modules have enabled attackers to:
- Create scheduled tasks
- Establish Registry persistence
- Execute remote commands
- Download additional files
- Maintain long-term access to compromised systems
This modular design allows operators to customize attacks depending on the victim.
Possible Connection to Mustang Panda
Although Fortinet stopped short of making a definitive attribution, researchers observed several techniques commonly associated with the Chinese cyber-espionage group Mustang Panda.
The campaign uses DLL side-loading, a method frequently employed by the threat actor to load malicious code while avoiding detection.
FDMTP itself has also appeared in previous operations linked to the group.
Who Was the Intended Target?
QuickFox is primarily used by Chinese students, expatriates, and professionals living outside mainland China to access internet services.
Researchers believe this makes overseas Chinese citizens one possible target of the campaign.
Another possibility is that the attackers intended to compromise foreign professionals who regularly interact with Chinese organizations for diplomatic, government, or commercial purposes.
At this stage, researchers say there is not enough evidence to determine which group was the primary objective.
Supply Chain Attacks Continue to Grow
The QuickFox incident highlights the growing danger of software supply chain attacks, where trusted applications are compromised before reaching users.
Because the malware was embedded inside an official software installer, victims had little reason to suspect they were installing anything malicious.
Security experts recommend downloading software only from official sources, verifying digital signatures where possible, and keeping endpoint protection software updated to detect unusual behavior during application installation.
The discovery also underscores the increasing sophistication of modern espionage campaigns, which continue to exploit trusted software supply chains to gain long-term access to targeted organizations and individuals.