China-aligned group abuses Sogou Input Method to deliver malware
Original title: China-Aligned Group Abuses Sogou Input Method to Deliver Malware
ESET researcher names SlippyNunchucks group and details DNS hijacking in Sogou app leading to DarkVigil malware delivery.
A China-aligned group hijacked the brand-promotion mechanism of Sogou Input Method to deliver the DarkVigil toolset. The campaign targeted users in six countries starting July 1 2026. DNS hijacking redirected legitimate app traffic to attacker-controlled servers, enabling persistence via the app's own components. Tencent fixed the unencrypted request in version 16.10.
Unconfirmed: ESET does not know where the DNS manipulation occurred
- Campaign targeted six countries including Hong Kong Thailand Japan Vietnam Sri Lanka and Oman
- Victims include a multinational gambling organization an internet cafe in Dubai and a university student in Denmark
- Group also used supply-chain compromise of QuickFox prior to this
- DarkVigil is a modular NET toolset with over 20 plugins
- Fix closes unencrypted request abused by attackers
Impact: Malware delivery via hijacked legitimate app traffic
- 1.Update Sogou Input Method to version 16.10
- ATT&CK
- T1573 DNS Spoofing
- Vendors
- Tencent
- Products
- Sogou Input Method
- Threat actors
- SlippyNunchucks
- Malware
- DarkVigil
From the original article
2 min read at infosecurity-magazine.com
SlippyNunchucks used DNS hijacking to turn Sogou brand promotions into a malware channel
By Alessandro Mascellino · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.