Black Hat special: Rewind and revisit

July 30, 2026 · Fortinet Threat Research · Severity: MEDIUM

Fortinet's FortiGuard Labs Incident Response team investigated a sophisticated supply chain attack targeting QuickFox, a popular software provider. The attackers compromised QuickFox's Windows installers, embedding a trojanized version that deployed an evolving FDMTP (Fileless Download and Memory-based Trojan Payload) implant. This malware was selectively distributed to specific victims, indicating a targeted campaign. The attackers leveraged the trust in QuickFox's software to infiltrate systems, enabling them to execute malicious payloads without detection. The attack primarily affected QuickFox users who downloaded the compromised installers, potentially exposing their systems to data theft, surveillance, and further exploitation. The use of fileless techniques and selective targeting highlights the attackers' advanced capabilities and intent to evade detection. This incident underscores the growing threat of supply chain attacks, which exploit trusted software providers to infiltrate organizations and individuals. It also emphasizes the need for robust security measures, including verifying software integrity and monitoring for unusual activity, to mitigate such risks.

The FortiGuard Labs Incident Response team analyzes a QuickFox supply chain attack that used trojanized Windows installers, selective targeting, and an evolving FDMTP implant