QuickFox VPN Malware Installed the FDMTP Backdoor

QuickFox users on Windows should check whether they ran a compromised installer, not merely update the VPN and assume the risk is gone. FortiGuard Labs reported on August 4 that trojanized QuickFox builds had delivered a JavaScript loader and the modular FDMTP backdoor since at least August 2025. QuickFox removed the malicious components from Windows version 3.59.6 after notification, but an update cannot remove a payload that an older build may already have installed.

The campaign did not treat every QuickFox user as a target. Its loader checked the computer first, skipped systems running Steam, and continued only when it found selected developer, database, messaging, translation, or cryptocurrency tools. That filtering makes the practical question narrower: which version ran, what programs were open, and did the QuickFox process create the documented files or network connections?

Who needs to act?

The confirmed execution path targeted Windows. Fortinet found the modified file in some macOS builds, but its Windows guardrail prevented the observed infection chain from progressing on macOS. The researchers found no matching behavior in the Android or iOS apps.

Fortinet’s sampled compromised Windows builds included 3.51.0, 3.52.0, 3.55.0, 3.55.5, 3.59.3, and 3.59.5. The list is not exhaustive because QuickFox does not provide a public archive of every historical installer. If the version is unclear, use the install date and the artifacts below instead of guessing from the current updater.

How the QuickFox supply-chain attack installed FDMTP

The attackers changed an HTML file inside QuickFox’s Electron application. When the program started, two added JavaScript lines fetched code from cdns3[.]51quickfox[.]cn. That domain imitates the legitimate cdns3[.]51quickfox[.]com host by changing the top-level domain; Fortinet states that the .cn domain is not official QuickFox infrastructure.

1. QuickFox launched the modified renderer file. The embedded JavaScript fetched an obfuscated loader.
2. The loader profiled the PC. It ran tasklist, stopped if steam.exe was present, and looked for 26 selected applications.
3. A matching system received the next stage. The script downloaded update.zip and extracted it under the user’s temporary QuickFox directory.
4. A legitimate Microsoft executable loaded a malicious DLL. The archive used csmonitor.exe to sideload Microsoft.ServiceHosting.Tools.dll; newer samples also used an encrypted update.bin.
5. FDMTP connected to attacker infrastructure. The implant reported system and network details, enumerated processes, and accepted additional compressed plugins from its command server.

The process filter included tools such as MobaXterm, FinalShell, DBeaver, Git, IntelliJ IDEA, Visual Studio Code, Notepad++, Telegram Desktop, Exodus, Binance, Ledger Live, and Trezor Suite. Finding one of these programs on a PC is not evidence of infection. It only explains why the malicious loader may have selected that system for the next stage.

QuickFox and FDMTP indicators worth checking

Fortinet also published hashes and staging infrastructure in its report. Use those indicators for a targeted hunt, but do not conclude that a clean domain lookup proves the PC was never exposed: infrastructure and plugins can change, while the local timeline and file relationships remain useful.

What to do after running an affected QuickFox version

1. Disconnect the computer if the old build ran. Disable Wi-Fi or unplug Ethernet before opening email, work consoles, password managers, or cryptocurrency tools.
2. Preserve the installation timeline. Record the QuickFox version, installer source and hash, install and first-run times, security alerts, child processes, and connections. A managed work device should go to the security team before manual cleanup.
3. Remove the old application and package. Uninstall QuickFox through Windows Settings, then quarantine the old installer. Downloading version 3.59.6 or later addresses the poisoned component, but it does not undo the earlier loader execution.
4. Run a full malware scan. Use updated protection to check the installer, QuickFox temporary directories, sideloaded DLL set, registry-held plugins, and any persistence or additional modules. Gridinsoft Anti-Malware can scan these locations and quarantine confirmed detections. Reboot and scan again if the files, alerts, or outbound connections return.
5. Review the affected tools. If Visual Studio Code, Git, database clients, remote administration tools, Telegram, or wallet software was open during the exposure window, inspect its recent activity and authentication history from a clean device.
6. Revoke access when evidence justifies it. End suspicious sessions and rotate credentials or keys that were accessible on the compromised PC. Contain and clean the system first so replacement secrets are not exposed again.
7. Escalate when remote access is confirmed. Unknown FDMTP plugins, security-tool tampering, new administrator access, or continuing command-and-control traffic is a reason to preserve evidence and rebuild Windows from trusted media rather than trust a partial file deletion.

The visible QuickFox application was only the starting point. Removing it or letting it update does not prove that update.zip, the sideloaded DLL, registry plugins, or a later module is gone. This is the same distinction that matters after any VPN-themed RAT installation: application cleanup, malware containment, and account recovery are separate tasks.

How to avoid a false alarm

Do not flag every QuickFox file, every csmonitor.exe, or every developer tool as malicious in isolation. Strong evidence combines the affected build and time window with the fake .cn host, the QuickFox temporary archive, the side-loaded DLL set, unusual child processes, or FDMTP network activity. If the installer was only downloaded and never run, follow the downloaded-but-not-opened safety check instead of treating the full attack chain as executed.

If the implant or a later plugin could access browser sessions or stored secrets, the infostealer recovery sequence explains why session revocation and clean-device password changes matter after containment.

FAQ

References

1. FortiGuard Incident Response Team. “QuickFox Supply Chain Attack Used to Deploy FDMTP Implant.” FortiGuard Labs, August 4, 2026; accessed August 8, 2026. Primary research, affected builds, indicators, and response context.