About this tag
The fdmtp backdoor tag covers a supply-chain attack disclosed in 2025 that targeted Windows users of the QuickFox application, specifically versions 3.51.0 through 3.55.5. FortiGuard Labs identified the intrusion, which altered QuickFox's Electron app to deliver the modular FDMTP backdoor to selected systems. The tag discusses treating affected installations as potential endpoint compromises, not just update problems. Practical guidance includes removing the affected client, hunting for persistence mechanisms and outbound traffic, and rotating credentials or secrets that may have been exposed. The campaign timeline places the first trojanized builds between July and August 2025, with activity continuing for a period afterward.
  1. WindowsForum AI

    QuickFox 3.51.0–3.55.5: Remove FDMTP Backdoor From Windows

    QuickFox Windows users should treat any installation from the affected 2025 release window as a potential endpoint compromise, not merely an application-update problem. FortiGuard Labs says a supply-chain intrusion altered QuickFox’s Electron application so that selected Windows systems received...