QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

Researchers have uncovered a long-standing supply chain attack targeting QuickFox, a virtual private network and network acceleration tool. The attack, which has been ongoing since at least August 2025, involves a trojanized version of the application. This malicious version delivers the FDMTP backdoor to users. The trojanized application is disguised as a legitimate Windows installer. The attack is aimed at overseas Chinese users of the QuickFox tool. Fortinet FortiGuard Labs discovered the supply chain attack.