Official installers for QuickFox VPN carried a backdoor for nearly a year

Security company Fortinet has found that the official installers for the QuickFox VPN service distributed a backdoor for nearly a year. The malicious components were introduced between 25 July and 13 August 2025, and the earliest affected version is 3.0.51.0. QuickFox is used mainly by Chinese users abroad who want faster access to Chinese services. The vendor removed the components after being notified by Fortinet, and version 3.59.6 is clean.

What happens technically

The attackers added two script lines to an HTML file that loads every time the application starts. The lines fetch code from the domain cdns3.51quickfox.cn, a lookalike of the vendor's real domain. The fake domain was registered on 9 June 2025. The code is heavily obfuscated, and it inspects the machine before anything else happens. If it finds the gaming platform Steam, it stops. It continues only when at least one of 26 applications tied to technical work is present, among them remote administration tools, developer tools, database tools, cryptocurrency wallets and Chinese translation software.

On selected machines the archive update.zip is downloaded. The archive contains the legitimate Microsoft utility csmonitor.exe, which on start loads a malicious library the attackers placed next to it. The technique is called DLL sideloading, and it means malicious code is started by a genuine, signed program. The library decrypts and starts the FDMTP backdoor. The implant collects the Windows version, username, network configuration, installed antivirus products, the title of the active window and running processes. It can also receive additional modules, store encrypted code in the Windows registry, download files and run programs. Fortinet does not confidently attribute the campaign to any particular actor. The company points at the same time to significant technical overlap with earlier reporting that others have attributed to the actor Twill Typhoon, including shared infrastructure and identical encryption keys. According to CyberInsider the macOS packages were also modified, but the attack code only proceeds on Windows.

What this means for you if you develop or run systems

The victim selection is the most telling part of this attack. The malware actively avoided private gaming machines, and it struck only where it found traces of development, operations or cryptocurrency. That description fits the machine you work on. We think the selection turns the usual thinking about consumer tools upside down. If you keep a private VPN application on your work machine, that was the way in here. The machines with the most valuable access were the ones picked out.

The attack was also hard to spot. The download came from the vendor's official channel, and the backdoor was started by a genuine, signed Microsoft utility. In our view that points to two weaknesses you will recognise from your own working day. One is the software you install yourself. The other is that developer and operations machines get treated like ordinary office computers. Keys, source code and production access live on exactly the machine you are sitting at.

Berigo recommends

• Build an inventory of VPN clients and accelerators on company machines, including those employees installed themselves.
• Control which applications can be installed on machines with access to code, operations and production.
• Hunt for csmonitor.exe outside known development environments, and for traffic to the domains in Fortinet's report.
• Treat developer and operations machines as high-value targets, with dedicated hardening and closer monitoring.
• Update QuickFox to version 3.59.6 or later where it is in use, or remove it.