QuickFox's installer shipped a backdoor for a year undetected

A real vendor's real Windows installer, downloaded from the vendor's own site, quietly installed a backdoor for roughly a year. That's the QuickFox supply chain attack Fortinet disclosed this week, and it is the version of supply chain risk most small businesses never audit: not npm, not a container base image, but the software your team installs on work laptops.

What actually happened

Per Fortinet FortiGuard Labs, reported by The Hacker News, QuickFox — a VPN and network acceleration tool aimed at Chinese users living abroad — shipped a trojanized Windows installer starting at version 3.0.51.0 and running through 3.59.5. The compromise dates back to at least August 2025. Version 3.59.6 removed the malicious components after disclosure.

The delivery mechanism is the part worth reading twice. The attackers modified an Electron renderer HTML file inside the installer. One embedded JavaScript payload imitated Firebase SDK traffic to fingerprint the machine and check with a command-and-control server whether it was already infected. A second stage used DLL side-loading to drop the FDMTP implant, which collects running programs, installed antivirus, and network details, then persists via scheduled tasks and registry keys. Fortinet observed two generations of the loader — one from September 2025, one from May 2026.

Fortinet describes "tactical overlaps with Mustang Panda," a Chinese state-sponsored actor. That is deliberate hedging on attribution, and we'll repeat it as hedged. No victim count was published.

Why endpoint software inventory matters for your business

You almost certainly cannot list what is installed on your team's machines. That is the actual finding here. A VPN utility that came from the right domain, at the right version, with a working installer, carried an implant for twelve months across two loader rewrites — and hash-based detection had nothing to match, because the hash was the legitimate build's hash.

Three things that would have helped, none of them exotic. Know what's installed: an inventory of every application on every work machine, refreshed automatically, is a weekend of setup and the only way you'll ever answer "are we affected." Watch egress, not files: a productivity app phoning a command-and-control host is visible in DNS logs even when the binary looks clean. Separate the machines that matter: whatever touches your admin console, your payment provider, or your customer database should not also be the laptop where someone installs a free network utility.

The uncomfortable version: "we only install software from official sources" is not a control. It was true here, and it did not help.

Sources: Fortinet FortiGuard Labs, The Hacker News.