Threats · 3h ago
ESET linked SlippyNunchucks to using Sogou Input Method to deliver DarkVigil in a campaign observed from July 1, 2026. The route followed the actor’s QuickFox supply-chain compromise; Tencent fixed the Sogou flaw in version 16.10.
Sogou normally fetches branded vocabulary promotions over HTTP, which does not protect the response from tampering. By hijacking the Domain Name System (DNS), attackers could redirect the request to their own server and return a malicious configuration, prompting the legitimate SGTool.exe component to help deliver the malware. Patching closes this route but cannot remove DarkVigil already delivered.
ESET also identified QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to in the campaign. For organizations supporting Chinese-speaking users, Sogou is one of several app-based paths; updating it does not establish that endpoints are clean or rule out exposure through another app.
2 sources covering this story
China-Aligned Group Abuses Sogou Input Method to Deliver Malware
SlippyNunchucks used DNS hijacking to turn Sogou brand promotions into a malware channel
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
China-aligned SlippyNunchucks hijacked Sogou Input Method DNS requests to deploy DarkVigil malware.
Part of the PlainSec briefing for 2026-11-04