"The attack is delivered via a modified Electron renderer HTML file used to download and execute a JavaScript-based loader," FortiGuard Incident Response Team said.
How the trojanized QuickFox installer worked
Fortinet FortiGuard Labs disclosed a supply chain compromise of QuickFox, a VPN and network acceleration tool aimed at overseas Chinese users, that began no later than August 2025. The intrusion involved a trojanized Windows installer that contained only two lines of JavaScript placed inside a single Electron renderer HTML file. Those two lines caused the installer to execute two staged JavaScript payloads hosted on a domain, cdns3.51quickfox[.]cn, which was designed to masquerade as the official QuickFox domain (51quickfox[.]com) to evade detection.
The JavaScript stage: firebase-app-compat.js and environment checks
Two payloads were referenced by the modified HTML. firebase-analytics-compat.js contained legitimate Google Firebase code. The other, firebase-app-compat.js, is a heavily obfuscated file that mimics the Firebase SDK but implements malicious logic. According to FortiGuard, that loader performs a fingerprinting routine that:
- verifies the endpoint is running Windows;
- checks with a command-and-control (C2) server to avoid re-infection;
- runs the tasklist command and inspects running processes.
The loader explicitly aborts if steam.exe is present and requires at least one process name match among 26 specified domestic applications, cryptocurrency wallets, developer tools, and enterprise software before proceeding to download a ZIP archive from the same attacker-controlled domain. The enumerated applications include Xshell, MobaXterm, Tabby Terminal, Navicat, DBeaver, Git, IntelliJ IDEA, Sublime Text, Notepad++, Microsoft Visual Studio Code, Exodus Wallet, Binance, Ledger Live, Trezor Suite, Telegram, SafeW, Ai Fanyi, Haiwang Chuhai, Yi Fanyi, Kuai Fanyi, and HaiYiTong.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we build →Second stage: ZIP payloads, DLL side-loading, and FDMTP
FortiGuard identified two generations of ZIP payloads. Generation 1 (available from at least September 2025) used DLL side‑loading to launch a malicious DLL that embedded FDMTP as Client.dll. Generation 2 (available from May 2026) also used DLL side‑loading but delivered a malicious DLL that acted as a loader for an encrypted file (update.bin) containing FDMTP.
FDMTP itself — first called out by Trend Micro in September 2024 as a secondary tool distributed via a downloader called PUBLOAD — attempts to establish a C2 connection and then responds to server instructions. FortiGuard reported the C2 issues a GetInfo request that collects a detailed snapshot of the victim device: the window title of the topmost active program, installed antivirus products, .NET Framework runtime version, network and operating system information, current username, and implant metadata (full file path, version, process ID, and hosting process name).
After exfiltrating that information the C2 can issue further requests to list running processes to filter targets and can instruct the implant to load plugins, enabling the operators to expand capabilities. Separate analysis cited by FortiGuard (from Darktrace) found payloads that manage scheduled tasks, ensure Registry persistence, and remotely fetch files or commands.
Tactical overlaps, suspected actors, and who may have been targeted
Fortinet did not make a firm attribution for the campaign, but noted tactical overlaps with Mustang Panda, "a Chinese nation-state adversary known for its reliance on DLL side-loading techniques to deploy malware." Given QuickFox's primary user base—Chinese international students and expats—FortiGuard offered two working hypotheses: that the campaign focused on Chinese citizens living outside China, or that it targeted professionals required to interact with Chinese native speakers for trade or diplomatic engagement. FortiGuard stressed that neither hypothesis can be confirmed without victim context from second-stage intrusions.
QuickFox remediation and timeline
Following responsible disclosure, QuickFox removed the malicious components from its Windows installer with the release of version 3.59.6. FortiGuard reported that the remediation was incorporated sometime between July 25 and August 13, 2025. The earliest known affected installer is version 3.0.51.0, and FortiGuard's evidence indicates the campaign targeted Windows users exclusively.
What this means for technologists, Chinese international students and expats, and professionals who interact with Chinese native speakers
- Technologists and security teams: Verify any QuickFox Windows installers in your environment and confirm they are version 3.59.6 or later. Look for signs of DLL side‑loading and the presence of FDMTP indicators, and consider post‑infection activity such as scheduled tasks, Registry persistence, and plugin fetches described by Darktrace.
- Chinese international students and expatriates: Users of QuickFox should update to the fixed installer (3.59.6) and treat any earlier Windows installer obtained between August 2025 and mid‑2026 as potentially compromised until verified.
- Professionals who interact with Chinese native speakers: FortiGuard’s competing hypothesis that the campaign targeted people who communicate regularly in Chinese underscores that systems used for cross‑border trade, academic collaboration, or diplomatic engagement may warrant prioritized review.
FortiGuard’s disclosure lays out a compact, modular attack chain: two lines of malicious JavaScript in a trusted installer, a heavily obfuscated loader that fingerprints targets and skips non‑desired environments, and a second‑stage implant (FDMTP) capable of data collection, process filtering, and plugin-driven expansion. The technical record establishes what the campaign did and when QuickFox removed the code; it does not, on its own, establish who among the product’s users were ultimately compromised. The next concrete step — and the unanswered piece that FortiGuard flagged — is victim context from second-stage intrusions that would show whom the operators chose to keep online.
