ESET Research says a China-aligned threat actor it tracks as SlippyNunchucks used DNS hijacking to redirect Windows Sogou Input Method traffic and deliver the DarkVigil backdoor to victims in six countries. The research published November 4 describes abuse of the application’s brand-promotion configuration mechanism and tracks the weakness as CVE-2026-120422.
The campaign redirected an Sogou component’s unencrypted HTTP request for a configuration file to attacker-controlled servers. The malicious configuration instructed the legitimate SGTool.exe component to download a signed Adobe helper renamed as a Sogou component manager and a rogue library, which side-loaded DarkVigil. ESET observed the activity beginning July 1, 2026, targeting users and organizations in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman.
ESET said the point where DNS resolution was manipulated remains unknown. Tencent released Sogou Input Method version 16.10 on October 29, moving the affected requests to HTTPS and enabling certificate pinning. The report follows an earlier Sogou Input Method flaw that enabled one-click backdoor installation, but describes a separate delivery route.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
