- ESET says a China-aligned group hijacked an unencrypted Sogou Input Method request to install its DarkVigil spyware on victims in Asia.
- The icon-config request was handled by SGTool.exe, a general task dispatcher. The forged config let the attacker place files where Sogou's component loader would run them.
- Ask vendors which of their requests still use plain HTTP, and check that Sogou Input Method is at version 16.10 or later.
A small request, left unprotected, became the way in
The attack did not start with a stolen signing key or a poisoned installer. It started with a request to fetch a small green icon.
ESET Research reports that a threat actor it calls SlippyNunchucks hijacked a request inside Sogou Input Method, a Chinese typing tool for Windows. The request belongs to a brand promotion feature. Through it, the group delivered its DarkVigil spyware to victims.
The mechanism was a DNS hijack. The attacker made the app fetch its settings from servers the attacker ran. Nothing in ESET's account says Sogou's own servers were breached.
This case suggests a simple point. An app is only as safe as its least-protected request. ESET found 20 request endpoints on one Sogou host that the app reaches over plain HTTP, even though the host supports HTTPS.
What ESET found
ESET's telemetry shows the first victims in early July 2026. They were in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, and each received the DarkVigil implant through Sogou Input Method.
The number of compromises and the range of countries first looked to ESET like an exploit. The cause was different. The attacker abused the app's use of plain HTTP and tampered with DNS.
DNS is the system that turns a website name into a server address. In victims' environments, the attacker controlled how a genuine Sogou hostname resolved. It pointed to one of two staging servers.
ESET could not say where the tampering happened. It lists three possibilities: routers with rogue DNS settings, routers infected with code that redirects lookups, or interception at the internet provider.
How the trick worked
Since 2016, Sogou's Startup Brand Support Program has let small companies submit brand names for the typing tool's vocabulary. Approved names appear with a green sprout icon.
To fetch those icons, the SGTool.exe component asks config.pinyin.sogou[.]com for a configuration file. ESET describes SGTool.exe as a multipurpose task dispatcher. It handles at least 30 command IDs, from skin management to dictionary updates.
The real configuration is encrypted with AES-256-CBC. ESET reports that the key and its companion value are embedded in SGTool.exe. Anyone who extracts them can build a config the app will accept. That is WebPulse's inference. ESET says the forged config was encrypted in a similar way.
Encryption keeps outsiders from reading a message. It does not show who wrote it. Here the app had no way to tell the attacker's config from the real one.
The forged config told the app to download two files. It also carried the md5 hash for each file, and the attacker edited those fields to match its payloads. So the attacker supplied both the file and the value used to check it. A check against a value from the same untrusted source proves nothing.
The config also set where the files would be saved. The locations let existing Sogou workflows run them.
In one route, a legitimate Adobe program, biz_helper.exe, was saved under the name SogouComMgr.exe. Sogou uses that name for the tool that installs and loads components. The Adobe program then loaded a malicious libcef.dll file, which started the implant.
The second route used a versioned folder under biz_center. ESET says both routes borrow Sogou's component-loading workflow, so they need no separate persistence mechanism.
Only one route can be in use at a time. ESET says the planting could break Sogou's normal functions. WebPulse infers that this might draw a user's attention.
Who is behind it
ESET assesses with high confidence that SlippyNunchucks is aligned with Chinese government interests. Public reports link DarkVigil to Mustang Panda. ESET says its telemetry shows no overlap and treats the group as distinct.
Since 2025, the group has abused several Chinese applications to deploy DarkVigil, including QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to. ESET says it mainly targets Chinese-speaking organizations and individuals in South and East Asia, with some in Europe.
Among the victims ESET names are a gambling operator active in Sri Lanka, the Philippines and Hong Kong, a café offering internet access in Dubai, and a student at a Danish university. Most organizations will not be in that group. The exposure applies to any software that fetches settings over plain HTTP and then acts on them.
What leaders should ask
ESET reported the issue to Tencent. Tencent released version 16.10, which moves the affected requests to HTTPS and enables certificate pinning. ESET's text gives two release dates, October 29 and October 30. Either way, any Sogou installation below 16.10 is a question for your IT team.
Beyond that one product, put three questions to your teams and vendors. Which business applications still make requests over plain HTTP? Ask for a list, not a reassurance.
Does any app fetch settings or files and then act on them, with checks that rely on values from the same source? Do you manage software used by staff on home or small-office networks, where ESET suspects router or provider-level DNS tampering may have occurred?
A feature that looks like decoration can still carry instructions. Treat every request an application makes as part of its attack surface.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: ESET.
