QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

The QuickFox supply chain attack demonstrates how threat actors can compromise trusted software distribution channels to deliver malware to unsuspecting users who believe they are installing legitimate software. Mustang Panda, a Chinese state-sponsored group, modified Electron renderer files within the Windows installer to silently download and execute the FDMTP backdoor — a technique that bypasses user suspicion because the compromise occurs within a trusted application bundle. This matters because VPN software, by its nature, is often granted broad network permissions, making it a high-value target for implanting persistent, stealthy access. The delay between the attack's onset (August 2025) and public disclosure underscores how supply chain compromises can persist undetected for extended periods, amplifying the blast radius across all users of the affected software.