QuickFox VPN Supply Chain Attack Deploys FDMTP Implant Linked to Twill Typhoon Hackers

A popular Chinese VPN proxy and game accelerator, QuickFox, has been weaponized in a long-running supply chain attack that quietly planted a persistent backdoor on Windows endpoints since at least August 2025.

FortiGuard Labs’ Incident Response Team disclosed the campaign on August 4, 2026, revealing how attackers tampered with QuickFox’s Electron-based installer to deliver an implant tracked as FDMTP, with technical fingerprints linking it to the China-nexus threat actor Twill Typhoon.

The compromise began with something deceptively simple: two lines of malicious JavaScript inserted into a legitimate HTML file (index.html) buried inside QuickFox’s Electron application archive.

QuickFox VPN Supply Chain Attack Deploys FDMTP

When the app initialized, this code silently fetched two JavaScript files from a typosquatted domain, cdns3[.]51quickfox[.]cn, registered in June 2025 to mimic the real 51quickfox[.]com infrastructure.

One file was genuine Firebase SDK code; the other, disguised as firebase-app-compat.js, was a heavily obfuscated loader using ten parallel layers of base91 decryption to evade static analysis.

Rather than infecting every user indiscriminately, the malware first performed reconnaissance. It checked running processes via tasklist, aborting immediately if steam.exe was active, a likely attempt to avoid personal gaming rigs.

It then only proceeded if one of 26 specific applications was running, a list heavily weighted toward Chinese translation tools, SSH clients, database managers, developer IDEs, and cryptocurrency wallets. This suggests the attackers were filtering for corporate or professional environments rather than casual gamers.

QuickFox VPN Supply Chain Attack Deploys FDMTP Implant Linked to Twill Typhoon Hackers

Qualified targets received update.zip, which abused DLL sideloading against a legitimate Microsoft binary, csmonitor.exe, to load a trojanized Microsoft.ServiceHosting.Tools.dll.

FortiGuard identified two generations of this loader: an earlier version embedding the final payload directly, and a newer variant (active since May 2026) that decrypts a separate update.bin file using a hardcoded AES-128-ECB key, notably the same key previously documented by Darktrace in unrelated FDMTP reporting.

The final payload, Client.dll, houses 15 compressed modules and establishes contact with hardcoded staging domains such as www[.]icloud-cdn[.]net and www[.]wangmeng[.]xyz, which return encoded C2 cluster addresses for direct socket communication.

Once connected, the implant harvests system fingerprints, installed antivirus products, network details, and running processes, then awaits modular plugins pushed from the C2 for further tasking, a design built for stealth and adaptability rather than immediate destruction.

FortiGuard stops short of formal attribution but notes strong technical overlap with Twill Typhoon activity, including matching sideloading tactics (MITRE ATT&CK T1574.001), shared C2 cluster IPs, and identical encryption keys.

QuickFox, once notified, quickly stripped the malicious components starting with version 3.59.6, though earlier tainted builds (v3.51.0 through v3.59.5) remained in circulation for roughly a year.

The campaign underscores a growing risk pattern: niche, ethnically targeted software with large diaspora user bases can become high-value supply chain targets precisely because they sit outside conventional enterprise threat models.

Organizations employing staff who rely on region-specific VPNs or productivity tools should apply the same scrutiny to these applications as to mainstream enterprise software.