China-Aligned Hackers Hijack Sogou Keyboard App to Install DarkVigil Malware
ESET tracks China-aligned group SlippyNunchucks abusing Sogou Input Method updates via DNS hijacking to deploy DarkVigil since mid-2026.
75
Victim
Internet café in Dubai
- Mentions · 7d1
- Mentions · 30d2
- All mentions2
- First seenNov 4, 2026
- Last mentioned6d ago
Timeline
2 articles · newest firstSlippyNunchucks hijacks Sogou Input Method to deploy DarkVigil malware
The SlippyNunchucks threat actor hijacked the Sogou Input Method branded vocabulary promotion mechanism to deploy DarkVigil implants targeting Chinese-speaking users in Asia and Europe.
75
Related CVEs
by mentions- HTTP config retrieval in Sogou Input Method for Windows
Appears with
- DarkVigilmalware · 2
- Sogou Input Methodproduct · 2
- SlippyNunchucksthreat actor · 2
- Tencentvendor · 2
- Philippinesvictim · 1
- Hong Kongvictim · 1
- Tencent Security Response Centerorganization · 1
- FDMTPmalware · 1
- ESETvendor · 1
- university student in Denmarkvictim · 1
- gambling operator in Sri Lankavictim · 1
- student in Denmarkvictim · 1
- multinational gambling organizationvictim · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.