Listen to this Post
Introduction: When Trusted Software Becomes the Perfect Weapon
Cybersecurity professionals have long warned that supply chain attacks are among the most dangerous forms of cyber warfare. Instead of attacking victims directly, threat actors compromise trusted software that users willingly download and install. Once that trust is broken, thousands or even millions of systems can become infected without raising immediate suspicion.
A newly disclosed campaign involving QuickFox, a popular VPN and network acceleration application designed primarily for overseas Chinese users, demonstrates exactly how devastating this strategy can be. Security researchers discovered that attackers quietly embedded malicious code inside legitimate QuickFox installers for months, allowing a sophisticated backdoor to be installed only on carefully selected targets. The operation appears to have been engineered with remarkable precision, indicating a highly organized espionage campaign rather than a traditional cybercriminal operation.
the Incident
Security researchers from Fortinet FortiGuard Labs have uncovered a long-running supply chain attack targeting users of QuickFox, a VPN service widely used by Chinese citizens living abroad to access Chinese online services and improve network connectivity.
According to the investigation, the malicious campaign has been active since at least August 2025. Rather than compromising users through phishing emails or malicious downloads, the attackers modified legitimate QuickFox Windows installers. The compromised installers silently delivered FDMTP, a sophisticated backdoor previously associated with operations conducted by the Chinese state-sponsored threat actor known as Mustang Panda.
The malicious components remained hidden inside official software packages until QuickFox released version 3.59.6, which removed the injected code after responsible disclosure by Fortinet. Researchers determined that Windows versions beginning with 3.0.51.0 were affected during the campaign.
The discovery highlights how trusted applications can unknowingly become distribution platforms for advanced malware, making supply chain compromises one of today’s most effective cyber espionage techniques.
How the Attack Started
Instead of replacing the entire application, the attackers made an incredibly subtle modification.
Only two lines of JavaScript were inserted into a single Electron HTML renderer file inside the installer. Those two lines downloaded two JavaScript files from a fake QuickFox infrastructure designed to closely resemble the company’s legitimate domain.
One script contained authentic Google Firebase code to avoid suspicion.
The second script disguised itself as another Firebase library while secretly performing extensive reconnaissance on the victim’s computer.
This minimalist modification significantly reduced the chances of detection by security software or code reviewers while maintaining the application’s normal functionality.
A Carefully Designed Victim Selection Process
Unlike ordinary malware that infects every available computer, this operation carefully filtered its victims before deploying the actual payload.
The JavaScript loader first confirmed that the operating system was Windows.
It then contacted a remote command-and-control server to verify whether the system had already been infected.
Next, it executed the Windows tasklist command to inspect every active process running on the device.
If Steam was detected, the infection process immediately stopped.
Researchers believe this unusual check may have been intended to avoid infecting gaming systems or virtual analysis environments commonly used by malware researchers.
The malware then searched for more than two dozen specific applications before deciding whether the device belonged to a valuable target.
High-Value Software Was the Real Target
The malware searched for software commonly used by developers, enterprise administrators, researchers, translators, cryptocurrency investors, and business professionals.
Among the targeted applications were:
Xshell
MobaXterm
Tabby Terminal
Navicat
DBeaver
Git
IntelliJ IDEA
Visual Studio Code
Sublime Text
Notepad++
Exodus Wallet
Binance
Ledger Live
Trezor Suite
Telegram
SafeW
Various Chinese translation applications
This selective approach demonstrates that the attackers were not interested in infecting random users.
Instead, they sought systems likely to contain valuable credentials, corporate information, cryptocurrency assets, diplomatic communications, or development environments.
Two Generations of Malware Delivery
Researchers identified two distinct versions of the malware deployment mechanism.
Generation One
Beginning around September 2025, attackers downloaded a ZIP archive containing a malicious DLL named Client.dll.
Using DLL side-loading, legitimate software unknowingly loaded the malicious library, which installed the FDMTP backdoor.
Generation Two
Beginning in May 2026, attackers evolved their techniques.
Instead of embedding the entire backdoor inside the DLL, the malicious DLL acted as a loader for an encrypted file named update.bin, which contained the FDMTP payload.
Separating the loader from the encrypted malware significantly complicated forensic analysis while increasing flexibility for future payload updates.
What FDMTP Does After Infection
Once installed successfully, FDMTP immediately attempts to establish communication with its remote command-and-control infrastructure.
The malware then gathers extensive intelligence from the infected computer.
Collected information includes:
Active application window
Installed antivirus products
Windows version
Network configuration
.NET Framework version
Current username
Process identifiers
Installation directory
Running process information
After transmitting this information to its operators, the malware receives additional commands from the remote server.
Its modular architecture allows operators to install new plugins capable of expanding functionality whenever necessary.
Researchers have observed plugins capable of:
Managing scheduled tasks
Creating Registry persistence
Executing remote commands
Downloading additional payloads
Uploading stolen files
Maintaining long-term access
This flexibility makes FDMTP an effective long-term espionage platform.
Why Mustang Panda Is Strongly Suspected
Although Fortinet stopped short of making a definitive attribution, investigators identified several operational characteristics consistent with previous Mustang Panda campaigns.
These similarities include:
Extensive DLL side-loading
Modular malware architecture
Highly selective victim filtering
Multi-stage payload deployment
Long-term persistence techniques
Sophisticated operational security
Mustang Panda has repeatedly demonstrated expertise in conducting cyber espionage against governments, NGOs, diplomatic organizations, academic institutions, and international businesses.
The similarities make this campaign highly consistent with the group’s historical tactics.
Why Overseas Chinese Users Were Attractive Targets
QuickFox primarily serves Chinese citizens living outside mainland China.
Many users rely on the service for:
Accessing domestic websites
Academic research
International education
Business communication
Government services
Cross-border financial activities
Researchers believe this unique user base presented attackers with an opportunity to identify individuals involved in international trade, diplomatic activities, technology research, education, or government-related communications.
An alternative theory suggests that foreign professionals regularly communicating with Chinese organizations may also have been among the intended victims.
Without visibility into second-stage compromises, determining the exact targeting strategy remains impossible.
Supply Chain Attacks Continue to Escalate
QuickFox joins a growing list of software platforms abused as malware delivery mechanisms.
Unlike phishing campaigns that depend on user mistakes, supply chain attacks exploit trust itself.
Victims install applications believing they originate from legitimate vendors, making security awareness alone insufficient to stop these attacks.
As software ecosystems become increasingly interconnected through cloud infrastructure, package repositories, automatic updates, and third-party dependencies, compromising one trusted application can silently expose thousands of organizations simultaneously.
This incident reinforces why software integrity verification, code-signing validation, behavioral monitoring, and zero-trust security models have become critical defensive measures for enterprises worldwide.
What Undercode Say:
The QuickFox compromise demonstrates how modern cyber espionage has evolved beyond exploiting software vulnerabilities. Attackers increasingly compromise trust itself.
Instead of forcing entry through traditional exploits, the attackers patiently modified a legitimate installer with only two lines of malicious JavaScript.
That tiny modification became the gateway for an advanced intelligence operation.
The selective victim profiling is perhaps the most fascinating aspect of this campaign.
The malware deliberately avoided infecting every computer.
Instead, it profiled each system before deciding whether the target deserved further compromise.
This dramatically reduced operational noise.
Lower infection rates also reduce the likelihood of security researchers discovering the campaign.
Checking for development tools strongly suggests an interest in software engineers and enterprise administrators.
Cryptocurrency wallet detection indicates possible financial intelligence objectives.
Translator applications suggest possible monitoring of international communications.
The absence of widespread destructive behavior further supports an espionage objective.
DLL side-loading remains one of the most reliable persistence techniques because legitimate executables often bypass endpoint detection.
Separating the encrypted payload from the loader represents another mature operational decision.
If defenders discover one component, they still face encrypted secondary payloads.
The modular architecture enables attackers to adapt after initial compromise without redeploying new malware.
Modern espionage increasingly resembles cloud software.
Capabilities are downloaded only when needed.
This reduces forensic artifacts.
It also minimizes behavioral detection.
Supply chain compromises are becoming more attractive than zero-day exploitation.
Compromising trusted software vendors scales efficiently.
Organizations often whitelist signed applications.
That trust becomes the
The campaign also demonstrates impressive operational patience.
Remaining undiscovered for months requires disciplined infrastructure management.
It also indicates extensive testing before deployment.
Organizations should continuously validate software behavior after installation instead of trusting digital signatures alone.
Behavioral analytics remain essential.
Network anomaly detection should complement endpoint protection.
Application allow-listing should include behavioral verification.
Threat hunting teams should monitor unexpected child processes launched by Electron applications.
DLL loading events deserve continuous visibility.
Encrypted outbound traffic should be inspected where legally permitted.
Incident responders should investigate unexplained connections to newly registered domains.
Continuous software supply chain auditing will become a standard enterprise requirement rather than an optional security enhancement.
Deep Analysis
The campaign provides several indicators defenders should actively investigate during threat hunting.
Useful Windows commands:
tasklist
netstat -ano
whoami
systeminfo
ipconfig /all
reg query HKCUSoftwareMicrosoftWindowsCurrentVersionRun
schtasks /query /fo LIST /v
wmic process list full
Get-Process
Get-NetTCPConnection
Get-WinEvent -LogName Security
Useful Linux investigation commands:
ps aux ss -tulpn lsof -i netstat -plant find / -name ".dll" find / -name ".bin" journalctl -xe grep -Ri "quickfox" /var/log sha256sum installer.exe strings installer.exe
Security teams should compare installer hashes against known-good releases, monitor DLL side-loading behavior, inspect Electron application resources for unauthorized JavaScript modifications, and validate outbound connections against trusted domains. Continuous integrity monitoring combined with endpoint detection and response significantly increases the likelihood of detecting similar supply chain compromises before widespread damage occurs.
✅ Fortinet publicly disclosed a long-running supply chain compromise affecting QuickFox Windows installers and linked the campaign to the FDMTP malware family.
✅ Researchers confirmed that the malicious installer selectively profiled Windows systems before deploying additional payloads using DLL side-loading techniques.
✅ While Fortinet identified strong tactical overlaps with Mustang Panda, the report stopped short of making a definitive attribution, meaning the connection remains an evidence-based assessment rather than a confirmed identification.
Prediction
(-1)
Supply chain attacks targeting trusted software distributors will continue increasing because they provide attackers with scalable access to carefully selected victims.
Future espionage campaigns will likely rely even more on modular malware, encrypted payloads, and behavioral filtering to remain undetected for extended periods.
Organizations that fail to implement software integrity verification, continuous monitoring, and zero-trust application controls will face significantly greater exposure to sophisticated supply chain compromises over the coming years.
▶️ Related Video (82% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: thehackernews.com
Extra Source Hub (Possible Sources for article):
https://www.discord.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
