China-Aligned Hackers Hijack Sogou Keyboard App to Install DarkVigil Malware
ESET tracks China-aligned group SlippyNunchucks abusing Sogou Input Method updates via DNS hijacking to deploy DarkVigil since mid-2026.
75
Vulnerability3 · 1 read
CVE-2026-120422
HTTP config retrieval in Sogou Input Method for Windows
- CVSS 4.0
- 8.9 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
Sogou Input Method for Windows SGTool.exe retrieves configuration data over unencrypted HTTP connections. An attacker who can manipulate network traffic can replace server responses with malicious configurations. This enables downloading attacker-controlled files to arbitrary paths, resulting in arbitrary code execution when loaded. Affected are all users running Sogou Input Method for Windows.
What to do: No fixed version or workaround specified.
| Product | Affected |
|---|---|
| Sogou Input Method for Windows | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.
- Vector
- CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:M/U:X
In the news
4 storiesChina-Aligned Hackers Hijack Sogou Input Method to Deploy DarkVigil Backdoor
Attackers abuse DNS hijacking in Sogou Input Method to deliver DarkVigil backdoor to Chinese-speaking users across Asia.
75
SlippyNunchucks hijacks Sogou Input Method to deploy DarkVigil malware
The SlippyNunchucks threat actor hijacked the Sogou Input Method branded vocabulary promotion mechanism to deploy DarkVigil implants targeting Chinese-speaking users in Asia and Europe.
75
SlippyNunchucks deploys DarkVigil through Sogou Input Method
ESET says DNS answers for plain-HTTP config checks were hijacked from July 1, 2026; Tencent fixed it in 16.10.
74