A malicious change was made to the legitimate QuickFox VPN installer, allowing it to secretly download a backdoor onto Windows PCs, according to Fortinet.