FortiGuard Labs uncovered a year-long supply chain attack hiding inside QuickFox, a popular VPN app used by Chinese expats and students to access Chinese services faster. The trojanized Windows installers delivered an FDMTP implant to corporate machines while deliberately avoiding personal gaming computers.
The attack began between July and August 2025. Attackers modified a single HTML file inside QuickFox’s Electron renderer to download malicious JavaScript from a typosquatted domain. The fake domain swapped QuickFox’s legitimate .com address with a .cn extension registered by someone named Lin Tianjun. That domain was registered just weeks before the first trojanized version appeared.
“QuickFox responded quickly to identify the trojanized components of their software, has since removed the reported components, and begun an internal investigation into the associated supply chain attack,” the report says.
The malicious JavaScript first checked if the victim’s machine was running Windows. It then ran a process scan. If Steam was detected, the attack stopped. FortiGuard assesses this guardrail was designed to avoid personal gaming machines. The malware only proceeded if it found at least one of 26 specific applications running. The target list included developer tools like Visual Studio Code, IntelliJ IDEA, and Git. It included database managers like Navicat and DBeaver. It included crypto wallets like Exodus, Binance, Ledger, and Trezor. It also included several Chinese translation tools used in cross-border business.
Once the guardrails passed, the JavaScript downloaded a zip file containing a legitimate Microsoft binary and a trojanized DLL. The legitimate csmonitor.exe sideloaded the malicious DLL, which then deployed the FDMTP implant. FortiGuard identified two generations of the loader. Generation 1 embedded the payload directly as a byte array. Generation 2 encrypted it separately using AES-128-ECB with a hardcoded key.
The implant itself operated through a plugin architecture. It connected to staging domains masquerading as iCloud, Yahoo, and Google services. These domains provided IP addresses for FDMTP communication clusters. The implant collected system information including active window titles, installed antivirus software, network details, and running processes. The C2 could push additional plugin DLLs remotely and store them in the Windows registry for persistence.
FortiGuard identified seven staging domains and ten cluster IPs, several still active at the time of disclosure. The infrastructure showed continuous evolution. API function names rotated through variants like GetSlaver, GetGateways, GetEndpoints, and GetNodes, indicating active development throughout the campaign.
QuickFox responded quickly after Fortinet’s responsible disclosure. The company removed malicious components from version 3.59.6 onward and launched an internal investigation. Affected Windows versions span from 3.51.0 through 3.55.5. Mac builds contained the modified HTML file but execution guardrails prevented the infection from progressing on non-Windows systems. iOS and Android versions showed no signs of compromise.
FortiGuard does not confidently attribute the campaign to a specific actor. However, significant technical overlap exists with infrastructure and tooling attributed to Twill Typhoon in earlier reporting by Darktrace. Shared C2 cluster IPs, identical AES encryption keys, and matching DLL sideloading techniques link the two campaigns with high confidence at the technical level.
