ESET linked SlippyNunchucks to using Sogou Input Method to deliver DarkVigil in a campaign observed from July 1, 2026. The route followed the actor’s QuickFox supply-chain compromise; Tencent fixed the Sogou flaw in version 16.10.
Sogou normally fetches branded vocabulary promotions over HTTP, which does not protect the response from tampering. By hijacking the Domain Name System (DNS), attackers could redirect the request to their own server and return a malicious configuration, prompting the legitimate SGTool.exe component to help deliver the malware. Patching closes this route but cannot remove DarkVigil already delivered.
ESET also identified QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to in the campaign. For organizations supporting Chinese-speaking users, Sogou is one of several app-based paths; updating it does not establish that endpoints are clean or rule out exposure through another app.