Hackers Turn Popular Chinese Keyboard Software Into a Backdoor for Cyberespionage Attacks

A China-aligned hacking group is abusing Sogou Input Method, one of the most popular Chinese typing tools, to secretly install a backdoor called DarkVigil on Windows computers.

The group is tracked as SlippyNunchucks. Since July 1, 2026, it has used the keyboard software to reach users in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman.

The hackers did not need a software exploit. Some of Sogou’s background requests travel over plain HTTP instead of secure HTTPS, so the attackers tampered with DNS, the system that turns website names into server addresses.

This sent the app’s request to a server they controlled. Tencent, which owns Sogou, fixed the weakness in version 16.10, and the issue now has the ID CVE-2026-120422.

Researchers at ESET, publishing on WeLiveSecurity, identified the malware and the hijacking method. In their detailed ESET research report they said they have tracked DarkVigil, also called FDMTP, since early 2025.

At first, the number of infections and their spread across many countries made them think an exploit was involved. The team later found the DNS hijacking instead.

Hackers Turn Popular Chinese Keyboard Software

The trouble starts with a Sogou part called SGTool.exe. It asks a server at config.pinyin.sogou[.]com for a small settings file that tells it which icon to download for a “brand promotion” feature.

Normally the file points to a harmless green sprout picture. In victim networks, the attackers controlled the DNS answer, so the request went to their own staging servers, which sent back a fake settings file.

That fake file told Sogou to download two items. One was a real, signed Adobe helper program, renamed biz_helper.exe.

The other was the DarkVigil implant, disguised as libcef.dll. The attackers also changed the checksum values in the file so Sogou’s own integrity check would accept the downloads.

The trick relies on DLL side-loading. When a trusted program starts, it loads a malicious file of the same name sitting next to it. This method is also seen in a Sogou one-click backdoor flaw reported in September.

The attackers saved the Adobe file as SogouComMgr.exe, so every time Sogou installed or loaded a component, it ran the Adobe file, which loaded the malware.

This gave the hackers lasting access without a separate persistence setup. As a backup, they also placed files in a biz_center folder in case an update replaced the first file.

The hijacking point is still unknown. ESET says compromised routers with bad DNS settings, routers carrying a DNS-hijacking implant, or interception at the internet provider level are all possible.

DarkVigil Malware, Targets and Defense

DarkVigil is a modular .NET toolset with more than 20 known plugins. It talks to its control server using the Duplex Message Transport Protocol (DMTP).

This protocol lets the server push plugins to the infected PC, which stores them in the Windows registry and runs them later. Stolen data is managed through a web panel branded “Vigil.”

SlippyNunchucks has been active since at least September 2023. Besides Sogou, it has abused other Chinese apps, including QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to.

This tactic is not new. Earlier, the TAOTH update hijacking campaign used a lapsed Sogou Zhuyin update server, and Notepad++ update traffic hijacked showed how selective update hijacking can work.

ESET says it does not link the group to Mustang Panda, even though some public reports do. The targets point to state interests. ESET found heavy spying on a company running Chinese-language betting platforms in Sri Lanka, Hong Kong and the Philippines.

Other victims included an internet café in Dubai and a student in Denmark. ESET judges with high confidence that the group works in line with Chinese government interests.

Users should update Sogou Input Method to version 16.10 or later right away. Security teams should look for connections to the domains and IPs below and for odd Adobe-named files inside Sogou’s Components folder.

Checking router DNS settings is also wise, because the same kind of trusted Windows apps abused in other China-linked campaigns often leaves little visible trace.

Indicators of compromise (IoCs):-

Malicious files

SHA-1	Filename	Detection	Description
8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23	libcef.dll	Win64/Agent.KSV	DarkVigil implant
3E16BA611782AF6E45576D390488D28FD676BADE	Microsoft.VisualStudio.HostingProcess.Utilities.Sync.dll	MSIL/DarkVigil_AGen.D	DarkVigil implant
79188C8DE2378B437D39E867475C5B4714A0D7C9	biz_helper.exe	Legitimate signed Adobe Licensing WF Helper, renamed	Used to side-load libcef.dll

Network indicators

IP	Domain	Hosting provider	First seen	Details
N/A	blog.wangmengfun[.]top	N/A	2026-07-08	DarkVigil bootstrap domain
N/A	update.mssproxy[.]net	N/A	2026-08-06	DarkVigil bootstrap server
N/A	img.fusfun[.]top	N/A	2026-08-06	DarkVigil bootstrap server
47.86.15[.]162	N/A	Alibaba Cloud – HK	2026-08-08	DarkVigil bootstrap server
47.236.254[.]159	dev.soft-png-cdn[.]com	Alibaba (US) Technology Co., Ltd.	2026-06-07	Hijacking domain and staging server
47.237.122[.]175	sogou-cdn[.]com	Alibaba (US) Technology Co., Ltd.	2026-07-21	Hijacking domain and staging server
47.239.250[.]102	sogou-cdn[.]com	Alibaba (US) Technology Co., Ltd.	2026-07-21	Hijacking domain and staging server

Note: IP addresses and domains are intentionally Qdefanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.