SlippyNunchucks hijacks Sogou Input Method to deploy DarkVigil malware
Original title: SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
The SlippyNunchucks threat actor hijacked the Sogou Input Method branded vocabulary promotion mechanism to deploy DarkVigil implants targeting Chinese-speaking users in Asia and Europe.
ESET tracked the SlippyNunchucks threat actor and its DarkVigil toolset since 2025. The group abused the Sogou Input Method's promotion mechanism to serve malicious configurations for payload placement and execution. ESET reported the vulnerability to Tencent, who released a fix in version 16.10. The operation targeted organizations and individuals across South and East Asia with additional European victims.
Unconfirmed: The point at which DNS manipulation occurs remains unknown.
- DarkVigil implants launched via SGTool.exe component of Sogou Input Method.
- Hijacked branded vocabulary promotion requests to serve malicious configs.
- Tencent fixed the issue in version 16.10 after ESET disclosure.
- CVE-2026-120422 issued for the identified security weakness.
Impact: DarkVigil malware deployment via hijacked input method promotion
- 1.Upgrade to Sogou Input Method version 16.10 or later
- CVEs
- CVE-2026-120422
- Vendors
- Tencent
- Products
- Sogou Input Method
- Threat actors
- SlippyNunchucks
- Malware
- DarkVigil
- Organizations
- Tencent Security Response Center
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-120422 | HTTP config retrieval in Sogou Input Method for Windows | 8.9 | — |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | sogou-cdn.com | .]175 – both of which served the attacker-controlled domain sogou-cdn[.]com . Subsequently, HTTP requests to the getBrandScd.php endp |
| domain | sogou.com | its components, sends an HTTP request to the config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php endpoint to retrieve a confi |
| ipv4 | 47.237.122.175 | ed it to one of their staging servers – 47.239.250[.]102 or 47.237.122[.]175 – both of which served the attacker-controlled domain sog |
| ipv4 | 47.239.250.102 | attacker who resolved it to one of their staging servers – 47.239.250[.]102 or 47.237.122[.]175 – both of which served the attacker-c |
| sha1 | 79188c8de2378b437d39e867475c5b4714a0d7c9 | dobe Licensing WF Helper, renamed to biz_helper.exe (SHA‑1: 79188C8DE2378B437D39E867475C5B4714A0D7C9 ), and the DarkVigil implant libcef.dll . The attacker modi |
| sha1 | f4e0b9a3b3fa449dfc77a596b44b4560b4d05a57 | e for Tencent Technology (Shenzhen) Company Limited (SHA‑1: F4E0B9A3B3FA449DFC77A596B44B4560B4D05A57 ). By contrast, our analysis of SGTool.exe revealed 20 requ |
From the original article
13 min read at welivesecurity.com
ESET Research analyzes a DNS hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method
welivesecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.