A hacking group aligned with China has manipulated a widely-used Chinese typing tool, Sogou Input Method, to stealthily install a backdoor called DarkVigil on Windows PCs. The group, known as SlippyNunchucks, has targeted users in several countries including Hong Kong, Thailand, Japan, and others since July 1, 2026.
Exploiting a Software Vulnerability
The attackers leveraged an inherent vulnerability in Sogou Input Method, where some of its background requests were sent over unencrypted HTTP, rather than HTTPS. By exploiting this, they tampered with the DNS—responsible for translating website names into server addresses—to redirect the software’s requests to a server under their control.
Tencent, the owner of Sogou, addressed this flaw in version 16.10 of the software, which has been assigned the identifier CVE-2026-120422. Researchers from ESET, publishing their findings on WeLiveSecurity, have been tracking the malware and the DNS hijacking methods employed by the hackers since early 2025.
Technical Details of the Attack
The attack initiates with a Sogou component named SGTool.exe, which ordinarily retrieves a configuration file for a ‘brand promotion’ feature. Exploiting this, the hackers redirected requests to a server they controlled, which sent back a malicious configuration file.
This file instructed Sogou to download two items: a legitimate Adobe helper program, renamed biz_helper.exe, and the DarkVigil malware disguised as libcef.dll. By altering checksum values, the attackers ensured that Sogou’s integrity checks were bypassed, allowing the malware to be installed without detection.
Defense and Recommendations
DarkVigil, a modular .NET-based toolset, communicates with its control server using the Duplex Message Transport Protocol, allowing the server to push additional plugins to the infected PC. These plugins are stored in the Windows registry and executed later, with data managed through a branded web panel called ‘Vigil’.
SlippyNunchucks has not only exploited Sogou but has also targeted other Chinese apps such as QuickFox and QingTalk. To mitigate risks, users should immediately update to the latest version of Sogou Input Method. Network administrators should examine router DNS settings and monitor for unusual activity, particularly involving Adobe-named files within Sogou’s directory.
This incident underscores the importance of maintaining up-to-date software to guard against such vulnerabilities. Regular monitoring and threat intelligence integration can help prevent similar cyber espionage attempts in the future.
