One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users

A single click on a malicious link could have given attackers a direct path into Windows systems running Sogou Input Method.

The flaw turned a commonly installed Chinese-language typing tool into an entry point for the GRAYRABBIT backdoor, exposing users to espionage, data theft, and remote control of their computers.

The attack was not based on a fake installer or a long chain of actions. A victim only had to open a specially prepared link delivered through a phishing email, a message, or a website.

Windows then passed the request to Sogou Input Method, where unsafe handling of the link opened an attacker-controlled page.

Researchers at Gen Digital identified the campaign while examining an active intrusion tied to the UNC3569 threat group.

They found that three separate weaknesses could be joined into a one-click remote-code-execution attack, allowing malicious code to run with the permissions of the signed-in Windows user.

Gen Digital said in a report shared with Cyber Security News (CSN) that its scale matters because Sogou is used by hundreds of millions of people, including home users, students, and businesses across China.

The issue, tracked as CVE-2026-51990, was reported to Sogou developer Tencent and fixed through version 16.3.0.3498, released through automatic updates.

The incident shows why people should treat unexpected links carefully, even when they appear to open a familiar desktop application, as recent coverage of critical Chrome code-execution flaws has also illustrated.

One Click on a Malicious Link

Sogou Input Method uses a Windows custom link type called sgbiz to let its components communicate. When a user opens one of these links, a program called bizhelper.exe reads its settings and starts the requested Sogou component.

It properly checked the name of the program to launch, but failed to check extra command-line instructions supplied with it.

Attackers abused that gap to start Sogou’s configuration application and tell it to open the skin marketplace page. That page contains an embedded Chromium-based browser.

Rather than limiting navigation to trusted Sogou sites, the application accepted an external address chosen by the attacker, turning the trusted program into a vehicle for a hostile web page.

The embedded browser made the chain especially dangerous. It relied on Chromium 80, a browser version dating to 2020, and researchers found its sandbox disabled along with important web protections.

This meant a JavaScript exploit could escape the normal browser boundary and run code on the host, a risk readers have seen in recent V8 engine security reports.

In the observed operation, UNC3569 used a known V8 flaw, CVE-2021-38003, to take control of the outdated browser component. The malicious code then retrieved files and used DLL sideloading, where a legitimate program loads a rogue companion file.

That technique remains effective because it can make harmful activity resemble normal Windows software behavior, as shown in this AsyncRAT sideloading campaign analysis.

Patch, Hunting, and Risk Reduction

The exploit path was actively used to deploy GRAYRABBIT. The backdoor can contact its operators, collect system details, run commands, open an interactive command shell, move files, and load additional modules, giving intruders a flexible foothold after the initial click.

Tencent completed and deployed its fix 12 days after receiving the disclosure, according to the researchers. The patch blocks unsafe URL-bearing options at the protocol-handler level, permitting HTTPS addresses only when their hostnames match an approved set.

However, researchers said the embedded browser remained old, unsandboxed, and configured with web security restrictions disabled.

Users should confirm that Sogou Input Method has updated to version 16.3.0.3498 or later and should apply future updates promptly.

Organizations with affected Windows endpoints should review telemetry for suspicious launches of Sogou components, unexpected child processes, and unusual outbound connections. Defenders should also reinforce link-filtering and user reporting practices, particularly after social-engineering attacks on Windows users.

Security teams can use the indicators below to search historical logs, endpoint records, DNS activity, and proxy data. Blocking confirmed hostile infrastructure, isolating suspected devices, and investigating related process activity can help contain an intrusion before the backdoor receives follow-on commands.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.