One Click on a Malicious Link Lets Hackers Backdoor Sogou Input Method Users

A single click on a malicious link could have given attackers a direct path into Windows systems running Sogou Input Method.

The flaw turned a commonly installed Chinese-language typing tool into an entry point for the GRAYRABBIT backdoor, exposing users to espionage, data theft, and remote control of their computers.

The attack was not based on a fake installer or a long chain of actions. A victim only had to open a specially prepared link delivered through a phishing email, a message, or a website.

Windows then passed the request to Sogou Input Method, where unsafe handling of the link opened an attacker-controlled page.

Researchers at Gen Digital identified the campaign while examining an active intrusion tied to the UNC3569 threat group.

They found that three separate weaknesses could be joined into a one-click remote-code-execution attack, allowing malicious code to run with the permissions of the signed-in Windows user.

Gen Digital said in a report shared with Cyber Security News (CSN) that its scale matters because Sogou is used by hundreds of millions of people, including home users, students, and businesses across China.

The issue, tracked as CVE-2026-51990, was reported to Sogou developer Tencent and fixed through version 16.3.0.3498, released through automatic updates.

The incident shows why people should treat unexpected links carefully, even when they appear to open a familiar desktop application, as recent coverage of critical Chrome code-execution flaws has also illustrated.

One Click on a Malicious Link

Sogou Input Method uses a Windows custom link type called sgbiz to let its components communicate. When a user opens one of these links, a program called bizhelper.exe reads its settings and starts the requested Sogou component.

It properly checked the name of the program to launch, but failed to check extra command-line instructions supplied with it.

Attackers abused that gap to start Sogou’s configuration application and tell it to open the skin marketplace page. That page contains an embedded Chromium-based browser.

Rather than limiting navigation to trusted Sogou sites, the application accepted an external address chosen by the attacker, turning the trusted program into a vehicle for a hostile web page.

The embedded browser made the chain especially dangerous. It relied on Chromium 80, a browser version dating to 2020, and researchers found its sandbox disabled along with important web protections.

This meant a JavaScript exploit could escape the normal browser boundary and run code on the host, a risk readers have seen in recent V8 engine security reports.

In the observed operation, UNC3569 used a known V8 flaw, CVE-2021-38003, to take control of the outdated browser component. The malicious code then retrieved files and used DLL sideloading, where a legitimate program loads a rogue companion file.

That technique remains effective because it can make harmful activity resemble normal Windows software behavior, as shown in this AsyncRAT sideloading campaign analysis.

Patch, Hunting, and Risk Reduction

The exploit path was actively used to deploy GRAYRABBIT. The backdoor can contact its operators, collect system details, run commands, open an interactive command shell, move files, and load additional modules, giving intruders a flexible foothold after the initial click.

Tencent completed and deployed its fix 12 days after receiving the disclosure, according to the researchers. The patch blocks unsafe URL-bearing options at the protocol-handler level, permitting HTTPS addresses only when their hostnames match an approved set.

However, researchers said the embedded browser remained old, unsandboxed, and configured with web security restrictions disabled.

Users should confirm that Sogou Input Method has updated to version 16.3.0.3498 or later and should apply future updates promptly.

Organizations with affected Windows endpoints should review telemetry for suspicious launches of Sogou components, unexpected child processes, and unusual outbound connections. Defenders should also reinforce link-filtering and user reporting practices, particularly after social-engineering attacks on Windows users.

Security teams can use the indicators below to search historical logs, endpoint records, DNS activity, and proxy data. Blocking confirmed hostile infrastructure, isolating suspected devices, and investigating related process activity can help contain an intrusion before the backdoor receives follow-on commands.

Indicators of compromise (IoCs):-

Type	Indicator	Description
URL	sgbizsgprocess?modulesgmyinput.exeparam-page3Dskincenter20-url3Dhttps253A252F252Fnoht1ng.top252Ffuckujjbangx.html	Malicious Sogou Input Method protocol link used to trigger the exploit chain
Domain	noht1ng.top	Exploit-page hosting domain
IP address	8.218.50.207	Staging server hosted on Alibaba Cloud in Hong Kong
Domain	mail.uaiubifas.top	GRAYRABBIT command-and-control domain using port 443
SHA-256	29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63	Trojanized DLL loader, originally identified as 7zp.dll with internal name boy.dll
SHA-256	749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e	Encrypted payload blob identified as p
SHA-256	D7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a	GRAYRABBIT backdoor with internal name core.dll
File name	7z.exe	Legitimate 7-Zip executable used as the DLL sideloading host
File name	7zp.dll	Downloaded trojanized DLL loader file
File name	7z.dll	Name used for the trojanized DLL on disk to enable sideloading
File name	p	Encrypted payload blob containing the final-stage RAT
File name	core.dll	Internal module name of the GRAYRABBIT backdoor

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.