Quick Fox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
Summary: Fortinet FortiGuard Labs reported a long-standing supply chain attack on QuickFox, a VPN and network acceleration tool for overseas Chinese users, running since at least August 2025 and delivering the FDMTP backdoor used by the Chinese state-sponsored group Mustang Panda. The trojanized Windows installer carried two lines of JavaScript in an Electron renderer HTML file that pulled payloads from cdns3.51quickfox[.]cn, a lookalike of the official 51quickfox[.]com domain, and QuickFox removed the malicious components in version 3.59.6, with 3.0.51.0 the earliest affected version.
Why it matters: The loader checked for 26 applications - including Xshell, MobaXterm, Navicat, VS Code, Binance, Ledger Live and Telegram - and only proceeded once at least one was running, so the presence of your developer and crypto tooling was itself the targeting condition. Fortinet could not confirm whether the campaign sought Chinese citizens abroad or professionals dealing with Chinese speakers, leaving the true victim set unidentified.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026