Hackers Turn Popular Chinese Keyboard Software Into a Backdoor for Cyberespionage Attacks

A China-aligned hacking group is abusing Sogou Input Method, one of the most popular Chinese typing tools, to secretly install a backdoor called DarkVigil on Windows computers.

The group is tracked as SlippyNunchucks. Since July 1, 2026, it has used the keyboard software to reach users in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman.

The hackers did not need a software exploit. Some of Sogou’s background requests travel over plain HTTP instead of secure HTTPS, so the attackers tampered with DNS, the system that turns website names into server addresses.

This sent the app’s request to a server they controlled. Tencent, which owns Sogou, fixed the weakness in version 16.10, and the issue now has the ID CVE-2026-120422.

Researchers at ESET, publishing on WeLiveSecurity, identified the malware and the hijacking method. In their detailed ESET research report they said they have tracked DarkVigil, also called FDMTP, since early 2025.

At first, the number of infections and their spread across many countries made them think an exploit was involved. The team later found the DNS hijacking instead.

Hackers Turn Popular Chinese Keyboard Software

The trouble starts with a Sogou part called SGTool.exe. It asks a server at config.pinyin.sogou[.]com for a small settings file that tells it which icon to download for a “brand promotion” feature.

Normally the file points to a harmless green sprout picture. In victim networks, the attackers controlled the DNS answer, so the request went to their own staging servers, which sent back a fake settings file.

That fake file told Sogou to download two items. One was a real, signed Adobe helper program, renamed biz_helper.exe.

The other was the DarkVigil implant, disguised as libcef.dll. The attackers also changed the checksum values in the file so Sogou’s own integrity check would accept the downloads.

The trick relies on DLL side-loading. When a trusted program starts, it loads a malicious file of the same name sitting next to it. This method is also seen in a Sogou one-click backdoor flaw reported in September.

The attackers saved the Adobe file as SogouComMgr.exe, so every time Sogou installed or loaded a component, it ran the Adobe file, which loaded the malware.

This gave the hackers lasting access without a separate persistence setup. As a backup, they also placed files in a biz_center folder in case an update replaced the first file.

The hijacking point is still unknown. ESET says compromised routers with bad DNS settings, routers carrying a DNS-hijacking implant, or interception at the internet provider level are all possible.

DarkVigil Malware, Targets and Defense

DarkVigil is a modular .NET toolset with more than 20 known plugins. It talks to its control server using the Duplex Message Transport Protocol (DMTP).

This protocol lets the server push plugins to the infected PC, which stores them in the Windows registry and runs them later. Stolen data is managed through a web panel branded “Vigil.”

SlippyNunchucks has been active since at least September 2023. Besides Sogou, it has abused other Chinese apps, including QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to.

This tactic is not new. Earlier, the TAOTH update hijacking campaign used a lapsed Sogou Zhuyin update server, and Notepad++ update traffic hijacked showed how selective update hijacking can work.

ESET says it does not link the group to Mustang Panda, even though some public reports do. The targets point to state interests. ESET found heavy spying on a company running Chinese-language betting platforms in Sri Lanka, Hong Kong and the Philippines.

Other victims included an internet café in Dubai and a student in Denmark. ESET judges with high confidence that the group works in line with Chinese government interests.

Users should update Sogou Input Method to version 16.10 or later right away. Security teams should look for connections to the domains and IPs below and for odd Adobe-named files inside Sogou’s Components folder.

Checking router DNS settings is also wise, because the same kind of trusted Windows apps abused in other China-linked campaigns often leaves little visible trace.

Indicators of compromise (IoCs):-

Malicious files

Network indicators

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.

The post Hackers Turn Popular Chinese Keyboard Software Into a Backdoor for Cyberespionage Attacks appeared first on Cyber Security News.