QuickFox , a popular VPN and network acceleration tool used primarily by Chinese students and expats abroad, has been the focus of a serious supply chain attack . According to researchers at Fortinet FortiGuard Labs, the attack had been ongoing since at least August 2025 and leveraged a forged Windows installer to install the FDMTP backdoor on select victims. The campaign is attributed to the Chinese state-sponsored threat actor Mustang Panda , also known as Twill Typhoon .
See also: Supply Chain Attack: TeamPCP Targets Developer Tools
QuickFox is particularly popular among Chinese international students and expats who want access to gaming servers and websites within China. This makes it an ideal distribution channel for espionage operations against a wide range of users — exactly the kind of target that state-sponsored groups are interested in. Fortinet revealed that the malicious code was introduced into the installer between July 25 and August 13, 2025 , with version 3.0.51.0 being the earliest affected. QuickFox removed the malicious elements with the release of version 3.59.6 , following a responsible disclosure.
The campaign targeted Windows. The attackers modified an Electron renderer HTML within the installer, inserting just two lines of JavaScript that triggered two malicious payloads: firebase-app-compat.js and firebase-analytics-compat.js. These payloads were hosted on the domain cdns3.51quickfox[.]cn, which was designed to resemble the legitimate domain 51quickfox[.]com, thus avoiding detection by security tools.
How the QuickFox supply chain attack works: Technical analysis
firebase -analytics-compat.js contained legitimate Google Firebase, while firebase-app-compat.js was a heavily obfuscated payload that mimicked the Firebase SDK. In reality, the second file performed a series of checks: it verified whether the system was running Windows, contacted a C2 server to determine if the endpoint was already infected, and executed the tasklist to obtain a list of running processes. This careful fingerprinting process reveals that the attackers were extremely selective — they didn’t want to infect random victims, but specific targets.
The loader checks to see if Steam (steam.exe) is running and terminates execution if it is found. It also looks for at least one of 26 applications that include development tools, enterprise software, and cryptocurrency wallets. Specifically, it checks for: Xshell, MobaXterm, Tabby Terminal, Navicat, DBeaver, Git, IntelliJ IDEA, Sublime Text, Notepad++, Microsoft Visual Studio Code, Exodus Wallet, Binance, Ledger Live, Trezor Suite, Telegram , and others. The presence of these applications suggests that the attackers were targeting developers, professionals, and cryptocurrency users — high-value profiles for espionage.
If both conditions were met, the script would download a ZIP archive from the same domain. Fortinet identified two generations of this payload: Generation 1 (available since at least September 2025) used DLL side-loading to launch a malicious DLL that embedded FDMTP (Client.dll). Generation 2 (available since May 2026) also used DLL side-loading, but launched a DLL loader that decrypted an update.bin containing FDMTP. The evolution between the two generations suggests that attackers were actively improving the delivery mechanism.
See also: TrapDoor: Supply Chain Attack on npm, PyPI and CratesIO
The FDMTP backdoor and the connection to the QuickFox supply chain
FDMTP was first identified by Trend Micro in September 2024 as a secondary tool distributed via a downloader known as PUBLOAD . In its most recent version, FDMTP first attempts to establish a connection to the C2 server , which responds with a GetInfo request to collect basic information from the victim's device. The data collected includes: the window title of the active program, installed antiviruses, .NET Framework runtime version , network and operating system information, current username, as well as details about the implant itself (full file path, version, process ID, process name).
Once this data is collected and extracted, the C2 server sends a request for a list of running processes, in a further attempt to filter endpoints. FDMTP is also responsible for loading additional payloads, making it a versatile espionage tool. The attributed group, Mustang Panda, is known for targeted espionage operations against governments, NGOs, and diasporas — choosing QuickFox as an attack vector fits this profile perfectly.
The QuickFox is part of a broader trend of supply chain exploits that has been prominent in 2026. Similar incidents include the fake DAEMON Tools Lite to deliver the QUIC RAT, as well as the TeamPCP , which the FBI issued a warning about. The common thread: attackers exploit users’ trust in legitimate software to deliver malware without arousing suspicion. The fact that the malware remained in the official app for about a year before being detected underscores the risk.
Recommendations for protection against the QuickFox supply chain attack
For organizations and users who may have been exposed, Fortinet recommends immediately updating QuickFox to version 3.59.6 or later on all Windows endpoints. In addition, network logs should be searched for the domain cdns3.51quickfox[.]cn , as well as suspicious JavaScript files with names that mimic the Firebase SDK. Detecting suspicious DLLs next to legitimate Electron is also a significant indicator of a breach.
At the network level, monitoring for C2 activity consistent with FDMTP, including initial beaconing communication and gathering system information via GetInfo. If trojanized installer or FDMTP, a full system reinstallation is recommended rather than a partial cleanup, as supply chain implants can persist through multiple stages. More generally, organizations should treat trusted installers as high-risk points and implement integrity checks, publisher verification, and controlled internal software distribution.
See also: GitHub Actions: Supply chain attack steals CI/CD credentials
The QuickFox case is a stark example of how dangerous supply chain attacks can be when they target tools used by vulnerable user groups. The campaign remained undetected for almost a year, highlighting the need for continuous monitoring of the software supply chain and stricter integrity checks on every application update.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
