China-Aligned Hackers Hijack Sogou Keyboard App to Install DarkVigil Malware
ESET tracks China-aligned group SlippyNunchucks abusing Sogou Input Method updates via DNS hijacking to deploy DarkVigil since mid-2026.
Stories per day · 30 days
1 RSS
Relateddarkvigil4sogou3espionage2slippy-nunchucks2backdoor1china-aligned1dll-sideloading1input-method1keyboard-app1slippynunchucks1sogou-input-method1surveillance1tencent1
9 stories, newest first · one card per story
Stories tagged #dns-hijacking
China-aligned group abuses Sogou Input Method to deliver malware
ESET researcher names SlippyNunchucks group and details DNS hijacking in Sogou app leading to DarkVigil malware delivery.
2
China-Aligned Hackers Hijack Sogou Input Method to Deploy DarkVigil Backdoor
Attackers abuse DNS hijacking in Sogou Input Method to deliver DarkVigil backdoor to Chinese-speaking users across Asia.
3
Hackers Hijack .gh, .sl and .as Registry to Obtain Unauthorized HTTPS Certificates
Attackers hijacked .gh, .sl, and .as registries to obtain unauthorized TLS certificates for Google and others.
2
Hackers obtain counterfeit TLS certificates for Google and other large services
Attackers who hijacked three ccTLD registries passed CA domain validation and obtained fraudulent TLS certificates for Google and other major services.
9
Russian State-Sponsored Hackers Use Claude to Rebuild Malware After Detection
Anthropic disrupted APT29-linked GTG-20006, which used Claude to autonomously rebuild malware, hijack hotel Wi-Fi DNS, and target 20-plus Ukrainian, European, and US-linked organizations.
9
Anthropic Says Russian Hackers Used Claude AI to Automate Malware Evasion
Anthropic disrupted Midnight Blizzard campaigns where AI agents automatically rebuilt malware to evade detection, targeting 20+ government and defense organizations.
Automatically Detecting DNS Hijacking in Passive DNS
Unit 42's machine learning pipeline detected 6,729 DNS hijacking events between March and September 2024, hitting political parties, ISPs, and universities.
2
Hacking Public Wi-Fi DNS to Steal Credentials
Attackers can hijack public Wi-Fi DNS to redirect users to credential-stealing fake login pages; commenters debate HTTPS limits and mitigations like encrypted DNS.
2