QuickFox Supply Chain Attack Used to Deploy FDMTP Implant

A long-running campaign compromised the QuickFox VPN application, primarily used by Chinese users to access Chinese resources and improve gaming experiences. Active since August 2025, the attack involved trojanized Windows installers (versions 3.0.51.0 through 3.59.5) that deployed malicious JavaScript through modified Electron renderer HTML files. The JavaScript loader fingerprinted victim endpoints using process-based guardrails, checking for specific applications including administrative tools, cryptocurrency wallets, and Chinese translation software while avoiding Steam users. Successfully profiled targets received an FDMTP implant through DLL sideloading techniques using legitimate Microsoft Azure binaries. The infrastructure demonstrates active development with multiple staging domains masquerading as legitimate services. QuickFox removed malicious components from version 3.59.6 following responsible disclosure. Technical overlaps suggest possible connections to Twill Typhoon, though attribution remain

• Yoba Malware Campaign Abuses Signed AI Applications to Evade DetectionMalware2026-11-03
• Shutting the Door on the XCPE BotnetMalware2026-11-02
• Black October for AI Developer PlatformsCampaign2026-10-31
• Camera Management Software Compromise Leads to Malware DeploymentMalware2026-10-27
• Gheist: Attempted Scaled Abuse of Stolen GitHub Tokens StumblesMalware2026-10-26