QuickFox Supply Chain Attack Used to Deploy FDMTP Implant
QuickFox Supply Chain Attack Used to Deploy FDMTP Implant
FortiGuard Labs is tracking a campaign associated with a long-standing supply chain attack on the QuickFox application, a VPN proxy and game accelerator typically employed by Chinese users. Active since at least August 2025, the supply chain attack involves a trojanized version of the QuickFox application.
The attack is delivered via a modified Electron renderer HTML file used to download and execute a JavaScript-based loader. Upon execution, the JavaScript loader fingerprints the victim endpoint to determine if it’s a valid target before downloading and installing an FDMTP implant. Analysis of infrastructure related to this campaign indicates active development, and infrastructure continues to be active at the time of publishing. Fortinet has contacted QuickFox, and QuickFox has since removed the malicious components from their Windows installer from v3.59.6. Malicious components transferred to MacOS do not result in infection progression.
The installer executable was trojanized by adding two lines of JavaScript to a single HTML file. This HTML file is executed by the Electron renderer, which is part of the main QuickFox application during initialization. These two added lines of JavaScript download and execute two JavaScript files from two URLs referencing the ‘cdns3.51[REDACTED BY DNB EDITORS TO GET PAST GOOGLE FILTERS].cn’ domain. Analysis of the domain identifies it was registered on 09 Jun 2025 by ‘林天俊 (Lin Tianjun)’. The domain appears to be an implementation of typosquatting that swaps the ‘.com’ TLD in the legitimate ‘cdns3.51[REDACTED BY DNB EDITORS TO GET PAST GOOGLE FILTERS].com’ with the ‘.cn’ TLD. To confirm, the ‘51[REDACTED BY DNB EDITORS TO GET PAST GOOGLE FILTERS].cn’ domain is not an official QuickFox domain. Analysis of previous versions of the QuickFox installer indicates the trojanized components were introduced sometime between 2025-07-25 and 2025-08-13. Execution guardrails in the initial downloaded JavaScript restricted execution to Windows endpoints, indicating the campaign was likely specifically targeting Windows users.
Analysis of the deobfuscated script identifies several key functions; the first is a check to validate the affected endpoint is running Windows. The third is to generate a list of processes using the tasklist command via a cmd.exe child process. This tasklist is then analyzed for specific process names. The script will stop and exit if a process named ‘steam.exe’ is in the tasklist output. FortiGuard Labs assesses that this guardrail is likely to restrict deployment of later-stage payloads to corporate computers. The next check is for 26 other process names related to a broad range of personal and business functions. Once the script has confirmed that Steam is not running and that at least one of the applications in the above list are running, the script will then download the next stage payload. Notably, JavaScript files are executed in the context of a dedicated child process spawned under the main QuickFox application process, which alters the process lineage for the infection.
The next stage of the JavaScript involves downloading ‘update.zip’ from ‘hxxp://cdns3.51[REDACTED BY DNB EDITORS TO GET PAST GOOGLE FILTERS].cn/2025090411/update.zip’. FortiGuard Labs identified two generations of the intrusion, both executing an FDMTP payload. After extraction, the script creates a ‘data.dat’ file as a mutex. It then executes ‘csmonitor.exe’, sideloading the malicious ‘Microsoft.ServiceHosting.Tools.dll’ DLL. The generation 2 sample (SHA256:795594AD5E6F2868CC4D8ED12DABF4F3999A1477C6B250527C5EDE9A98528FB9) decrypts ‘update.bin’ using AES-128-ECB encryption with the key ‘POt_L[Bsh0=+@0a.’ The decrypted contents are the final FDMTP payload ‘Client.dll’, containing 15 compressed modules. The FDMTP implant then attempts to obtain a C2 connection via the ‘Client.Program.InitConnect() method.’