Four Million Malware Reports Reveal a Widespread No

Gbhackers •Mayura Kathir • August 5, 2026

A long‑running supply chain compromise of the QuickFox VPN accelerator that quietly delivered an FDMTP backdoor to carefully profiled Windows systems, exposing a major blind spot in defenders’ visibility where command‑and‑control (C2) traffic never touches traditional DNS. The attackers added just two lines of JavaScript to an internal Electron renderer HTML file, causing the app […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

QuickFox VPN Supply Chain Attack Delivers FDMTP Backdoor to Windows Users A supply chain attack targeting the QuickFox VPN application has been uncovered, affecting Windows users. The attack, attributed to the Chinese state-sponsored group Mustang Panda, involved a trojanized version of the QuickFox app that was modified to include malicious JavaScript. This JavaScript loader fingerprints the victim's system to identify valid targets before installing the FDMTP backdoor, which can exfiltrate sensitive information. The compromised versions of QuickFox range from 3.51.0 to 3.55.5, with the attack active since at least August 2025. QuickFox has since removed the malicious components in version 3.59.6 and is conducting an internal investigation. The attack primarily targets Chinese users abroad, including students and professionals. The malicious code was delivered via a lookalike domain registered in June 2025, and the infrastructure remains active at the time of reporting. 14 sources 76

Extracted Entities

Four Million Malware Reports Reveal a Widespread No

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (3)

Platforms (2)