Trojanized installers strike again.

QuickFox app users received an unsolicited bonus when a poisoned Windows installer delivered state-sponsored spyware. Attackers tampered with internal HTML components to drop obfuscated JavaScript loaders that fingerprinted endpoints for the FDMTP backdoor. Mustang Panda threat actors clearly enjoyed watching unsuspecting users install backdoored software without a second thought. To prevent such misery, we ought to rigorously verify software installer integrity before executing unvalidated executables.