What Happened: A VPN Supply Chain Attack Hiding in Plain Sight
A sophisticated VPN supply chain attack has been uncovered targeting QuickFox, a popular virtual private network and network acceleration tool used primarily by overseas Chinese users — including international students, expats, and professionals who need to access services back home. According to research published by Fortinet FortiGuard Labs, the attack has been ongoing since at least August 2025 and involved a trojanized version of the QuickFox Windows installer that silently deployed a backdoor known as FDMTP, a malware tool previously linked to Mustang Panda, a Chinese state-sponsored threat actor.
What makes this incident especially significant for IT security professionals and privacy-conscious users is the attack's supply chain delivery mechanism. Rather than tricking users into downloading a fake app from a third-party site, the malicious code was embedded directly into the legitimate QuickFox Windows installer — meaning users who downloaded and installed the software through normal channels were at risk. The compromised versions span from 3.0.51.0 up to (but not including) version 3.59.6, which was patched after responsible disclosure to QuickFox.
Supply chain attacks of this nature are considered among the most dangerous categories of cyber intrusion. Unlike phishing or drive-by downloads, they exploit the implicit trust that users and organizations place in software vendors. When a user installs what appears to be a legitimate, version-controlled application from a known provider, they have little reason to suspect the installer itself has been compromised. This is precisely what makes the QuickFox incident a textbook — and alarming — example of how nation-state actors can operate quietly inside trusted software ecosystems.
How the FDMTP Backdoor Was Delivered and What It Does
The attack's technical architecture is both sophisticated and instructive for security professionals. The malicious modification involved just two lines of JavaScript inserted into a single Electron renderer HTML file — a minimal footprint that helped it evade detection for an extended period. These two lines triggered the download and execution of two JavaScript payloads staged on a domain ("cdns3.51quickfox[.]cn") designed to mimic QuickFox's legitimate domain ("51quickfox[.]com"), a classic domain-spoofing technique used to bypass automated threat detection.
Of the two payloads, one ("firebase-analytics-compat.js") contains entirely legitimate Google Firebase code — included presumably to add credibility and reduce suspicion during any automated or manual inspection. The second payload ("firebase-app-compat.js") is heavily obfuscated and mimics the Firebase SDK in appearance, but contains malicious logic designed to perform target validation before proceeding with the infection.
That validation process is notably selective. The script first checks whether the endpoint is running Windows, then contacts a command-and-control (C2) server to confirm the device hasn't already been infected. It then runs the Windows "tasklist" command and checks the list of running processes for specific applications. If Steam ("steam.exe") is detected, execution is aborted — likely to avoid infecting consumer gaming machines that don't match the attack's intended target profile. The script then checks for the presence of at least one process from a list of 26 applications spanning developer tools, enterprise software, and cryptocurrency wallets.
Applications Checked by the FDMTP Loader
Once both conditions are satisfied — Windows confirmed, and at least one target-profile application running — the script proceeds to download a ZIP archive containing the next-stage payload. Fortinet identified two generations of this payload. The first generation, available from at least September 2025, uses DLL side-loading to launch a malicious DLL directly embedding FDMTP ("Client.dll"). The second generation, available from May 2026, adds an extra layer of obfuscation: DLL side-loading loads a malicious DLL that acts as a loader for an encrypted file ("update.bin") which itself contains FDMTP.
DLL side-loading is a well-documented technique favored by Mustang Panda and other Chinese state-sponsored groups, as catalogued in MITRE ATT&CK. It works by placing a malicious DLL alongside a legitimate executable, tricking that executable into loading the malicious library instead of the intended one. It is particularly effective at bypassing security tools that trust the parent executable.
Inside FDMTP: What Data the Backdoor Collects
FDMTP was first identified in September 2024 by Trend Micro, where it was described as a secondary tool distributed via a downloader called PUBLOAD. In the QuickFox campaign, the backdoor initiates contact with its C2 server upon installation. The server responds with a "GetInfo" request, triggering the collection of a comprehensive victim profile.
The data harvested includes the window title of the topmost active application (revealing what the user is doing), installed antivirus programs, .NET Framework runtime version, network and operating system details, the current username, and technical metadata about the implant itself — including file path, version, process ID, and hosting process name. This kind of fingerprinting is consistent with a targeted intelligence operation rather than mass credential theft or ransomware deployment.
"The attack's selectivity — filtering for developer tools, enterprise software, and even specific translation apps — suggests a deliberate effort to identify high-value targets rather than maximize infection volume. This is the hallmark of state-linked espionage, not commodity malware."
— Fortinet FortiGuard Incident Response TeamAfter exfiltration of the initial device profile, the C2 server sends a follow-up command to list all running processes — a second layer of target filtering designed to further narrow down which infected machines receive additional attention. The malware also supports plugin loading from the server, allowing the operators to expand or customize its capabilities dynamically. As documented by Darktrace in prior reporting, known plugins facilitate scheduled task management, Registry-based persistence, and remote file or command retrieval.
Who Was Being Targeted — and Why That Matters for Digital Privacy
QuickFox's primary user base consists of overseas Chinese users — international students, business professionals, and expats who rely on the VPN service to bypass regional internet restrictions and access Chinese-language services from abroad. This demographic context shapes two competing interpretations of the campaign's intent, both raised by Fortinet in its disclosure.
The first hypothesis is that the campaign directly targeted Chinese nationals living outside China — a pattern consistent with other documented operations attributed to Mustang Panda, which has historically been used against civil society organizations, diaspora communities, and political dissidents. The second hypothesis is that the attackers sought to reach professionals who regularly interact with Chinese-speaking counterparts, possibly in trade, diplomacy, or cross-border business contexts.
Neither theory has been confirmed, and Fortinet notes that confirming either would require visibility into the victim context for second-stage intrusions — data that is not currently public. What is clear is that the attack's target profiling is highly sophisticated. The combination of filtering out Steam users (casual gamers) while screening for Navicat, DBeaver, Xshell, IntelliJ IDEA, and enterprise-grade translation software paints a very specific picture of the intended victim: a technically proficient professional with connections to Chinese-language business or data infrastructure.
For IT decision makers and privacy professionals in Europe and elsewhere who work with Chinese partners, supply chain or trade teams, or multinational organizations, this is a meaningful threat vector. The use of a VPN — a tool typically associated with privacy and security — as the delivery mechanism is particularly ironic, and underscores a broader lesson: trust in a software product cannot substitute for independent verification of its security posture.
Mustang Panda and the Broader Landscape of State-Sponsored VPN Exploitation
Although Fortinet stopped short of formally attributing this campaign to Mustang Panda, the overlap in tactics is significant. Mustang Panda — also tracked under aliases including TA416, RedDelta, and Earth Preta — is one of China's most active and persistent advanced persistent threat (APT) groups, with a documented history of targeting governments, NGOs, religious organizations, and diaspora communities across Southeast Asia, Europe, and beyond. Its hallmark is the use of DLL side-loading to deploy custom malware with minimal footprint, a technique used identically here.
Research from
Originally reported by RSS App New Cybersecurity Feed. Summarised and curated by European Purpose.
