QuickFox Supply Chain Attack Delivers FDMTP Backdoor to Overseas Chinese Users

A compromised build pipeline has resulted in a long-standing QuickFox supply chain attack, where legitimate installers for the network acceleration and VPN service were trojanized to deploy the FDMTP backdoor. The malicious campaign, which targeted Windows endpoints, operated undetected from at least August 2025 until QuickFox quietly purged the malicious components in version 3.59.6.

QuickFox is widely used by Chinese international students, expatriates, and foreign professionals needing high-speed connectivity to mainland Chinese services. Because desktop VPN and accelerator clients operate with elevated network and system privileges, compromising their software distribution pipeline grants threat actors immediate, trusted access to high-value endpoints across global networks.

Inside the Trojanized Installer

The attackers compromised QuickFox’s Windows build infrastructure starting around version 3.0.51.0. Rather than modifying the primary binary executable directly, the threat actor altered a core Electron renderer HTML file embedded within the application package. Electron applications run on a bundled Chromium framework, making local HTML files an ideal vector for script injection.

The injected code comprised just two lines of JavaScript pointing to scripts hosted on cdns3.51quickfox[.]cn—a domain designed to mimic QuickFox’s legitimate domain (51quickfox[.]com). The installer executed two staging scripts:

• firebase-analytics-compat.js: Legitimate Google Firebase SDK code included to maintain structural credibility and bypass basic static analysis.
• firebase-app-compat.js: A heavily obfuscated, malicious script mimicking the Firebase SDK interface while executing fingerprinting and loader logic.

Before deploying any secondary payloads, the loader runs strict victim-validation checks to ensure it only infects true targets and avoids security sandboxes. It queries the local system using the native tasklist command and applies two key filtering conditions:

1. Exclusion Check: If steam.exe is present in the active process list, the script immediately aborts execution. This filters out casual gamers and automated dynamic analysis sandboxes configured with consumer software profiles.
2. Target Matching: The script verifies that at least one of 26 specific applications is running. These targets span developer tools, SSH clients, database management software, cryptocurrency wallets, and specialized translation utilities:
   • Dev/Admin Tools: Xshell, MobaXterm, Tabby Terminal, Navicat, DBeaver, Git, IntelliJ IDEA, Sublime Text, Notepad++, Visual Studio Code.
   • Crypto & Wallet Software: Exodus Wallet, Binance, Ledger Live, Trezor Suite, SafeW.
   • Communication & Translation Apps: Telegram, Ai Fanyi, Haiwang Chuhai, Yi Fanyi, Kuai Fanyi, HaiYiTong.

If the target criteria are satisfied, the script contacts the command-and-control (C2) server to prevent duplicate infections before downloading a secondary ZIP archive containing the final payload stage.

Payload Delivery and FDMTP Capabilities

The campaign evolved across two distinct deployment generations to refine payload delivery and evade endpoint detection and response (EDR) agents:

• Generation 1 (September 2025 onwards): The downloaded ZIP archive leveraged traditional DLL side-loading. A legitimate executable side-loaded a malicious library named Client.dll, which contained the embedded FDMTP backdoor payload.
• Generation 2 (Observed by May 2026): The architecture shifted to add an obfuscation layer. The side-loaded DLL served purely as a loader to decrypt an accompanying file named update.bin, which contained the FDMTP implant in memory.

FDMTP is a custom, full-featured remote access trojan (RAT) first observed in late 2024 as a secondary payload delivered via the PUBLOAD downloader. Once activated, FDMTP initiates an outbound connection to its C2 server, which immediately issues a GetInfo tasking directive.

The malware harvests extensive host context, including the active foreground window title, installed antivirus products, .NET runtime versions, local username, internal IP address, host process ID, and full file system paths. Following host profiling, the C2 server performs a second-stage process check to decide which specialized post-exploitation plugins to push down. These modules grant operators fine-grained control to establish Registry persistence, manage Windows Scheduled Tasks, pull supplementary files, and execute arbitrary command-line instructions.

Attribution and Strategic Impact

While published analysis refrains from explicit attribution, the operational tradecraft, target profile, and toolchain align closely with Mustang Panda (also tracked as Bronze President, TA416, or RedDelta). Mustang Panda is a prolific Chinese state-sponsored advanced persistent threat (APT) group known for long-term cyber espionage campaigns targeting diplomatic, government, and diaspora entities using DLL side-loading frameworks.

The targeting profile suggests two primary intelligence objectives:

1. Surveillance of Chinese Diaspora: Monitoring overseas Chinese nationals, dissidents, students, and expatriates who rely on network accelerators like QuickFox to maintain access to domestic services or bypass regional network controls.
2. Access Operations against Foreign Entities: Opportunistically gaining footholds into foreign corporate, diplomatic, or academic networks where employees or contractor staff use Chinese translation software, developer environments, and network tools on corporate-issued or BYOD Windows endpoints.

The blast radius extends beyond consumer devices; any corporate workstation where an employee installed QuickFox to access regional services served as a bridge into the broader enterprise environment.

Remediation and Mitigation Guidelines

QuickFox addressed the supply chain compromise by purging the malicious HTML references in version 3.59.6, released between late July and August 2025.

Security teams should immediately take the following actions:

• Upgrade or Uninstall: Verify all installed instances of QuickFox on Windows endpoints are running version 3.59.6 or higher. Immediately isolate systems running versions between 3.0.51.0 and 3.59.5.
• Block Network Indicators: Add the malicious infrastructure domain cdns3.51quickfox[.]cn and associated IP endpoints to egress filtering rules, secure web gateways, and DNS firewalls.
• Inspect Endpoint Artifacts: Hunt for unauthorized execution of tasklist spawned by Electron renderer processes, as well as the creation of unverified DLLs paired with legitimate executables in QuickFox application directories. Search for instances of update.bin in user profile directories.
• Audit High-Risk Applications: Review environments where tools like Xshell, MobaXterm, or Navicat are routinely deployed alongside unauthorized VPN or accelerator software.