QuickFox VPN targeted in long-standing supply chain attack delivering FDMTP backdoor

In a report by The Hacker News, researchers disclosed a long-standing supply chain attack targeting QuickFox, a VPN and network acceleration tool used by overseas Chinese users. The attack, ongoing since at least August 2025, involves a trojanized version of the application used to deliver FDMTP, a backdoor attributed to the Chinese state-sponsored threat actor Mustang Panda.

The attack begins with a modified Electron renderer HTML file that downloads and executes a JavaScript loader. This loader identifies valid Windows targets before installing the FDMTP implant. The malicious code was embedded in QuickFox's Windows installer, with version 3.0.51.0 being the earliest affected. The loader checks for specific processes, such as Steam, and a list of 26 domestic applications, cryptocurrency wallets, and developer tools, before downloading the next stage payload. This payload, delivered via a ZIP archive, uses DLL side-loading to deploy FDMTP. FDMTP gathers system information, including active programs, antivirus software, and network details, and exfiltrates it to a command-and-control server. The malware can also manage scheduled tasks and Registry persistence. While Fortinet has not directly attributed the campaign, it notes tactical overlaps with Mustang Panda. Given QuickFox's user base, the campaign may target Chinese citizens abroad or professionals interacting with Chinese speakers.

Source: The Hacker News