SlippyNunchucks deploys DarkVigil through Sogou Input Method
ESET says DNS answers for plain-HTTP config checks were hijacked from July 1, 2026; Tencent fixed it in 16.10.
74
- Mentions · 7d2
- Mentions · 30d5
- All mentions5
- First seenNov 4, 2026
- Last mentioned6d ago
Timeline
5 articles · newest firstChina-Aligned Hackers Hijack Sogou Keyboard App to Install DarkVigil Malware
ESET tracks China-aligned group SlippyNunchucks abusing Sogou Input Method updates via DNS hijacking to deploy DarkVigil since mid-2026.
75
China-aligned group abuses Sogou Input Method to deliver malware
ESET researcher names SlippyNunchucks group and details DNS hijacking in Sogou app leading to DarkVigil malware delivery.
60
China-Aligned Hackers Hijack Sogou Input Method to Deploy DarkVigil Backdoor
Attackers abuse DNS hijacking in Sogou Input Method to deliver DarkVigil backdoor to Chinese-speaking users across Asia.
75
SlippyNunchucks hijacks Sogou Input Method to deploy DarkVigil malware
The SlippyNunchucks threat actor hijacked the Sogou Input Method branded vocabulary promotion mechanism to deploy DarkVigil implants targeting Chinese-speaking users in Asia and Europe.
75
Related CVEs
by mentions- HTTP config retrieval in Sogou Input Method for Windows
Appears with
- SlippyNunchucksthreat actor · 5
- Tencentvendor · 5
- Sogou Input Methodproduct · 5
- DarkVigilmalware · 5
- multinational gambling organizationvictim · 2
- university student in Denmarkvictim · 2
- Internet café in Dubaivictim · 2
- ESETvendor · 2
- Fortinetvendor · 1
- ESETorganization · 1
- Tencent Security Response Centerorganization · 1
- QuickFoxproduct · 1
- Philippinesvictim · 1
- Vietnamvictim · 1
- organizations and Chinese-speaking individuals in Hong Kongvictim · 1
- Omanvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.