Widely used Chinese keyboard app became a vehicle for cyberattacks

ESET Research has found that the China-aligned threat group SlippyNunchucks hijacked a language application to distribute malware overseas.

Dji Banner Inside Article - 728x90

ESET, a global leader in cybersecurity, has revealed that a China-aligned cyberattack group exploited a vulnerability in a widely used Chinese keyboard application to target users in different countries. ESET researchers uncovered an operation in which the group distributed malware through the application and carried out attacks by redirecting users' internet connections. Tencent, the application's developer, released an update to close the vulnerability.

Windows versions of Sogou Input Method targeted

ESET Research detected and analysed a DNS-hijacking operation exploiting insecure HTTP communication in the Windows versions of Sogou Input Method, a Chinese input method editor developed by Tencent. The China-aligned advanced persistent threat (APT) group SlippyNunchucks is behind this latest surveillance campaign. The group, which operates the DarkVigil malware ecosystem, targeted organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. SlippyNunchucks was also able to reach users across Asia and Europe.

ESET researcher Anh Ho, who discovered the operation and the vulnerability, explained: “In July 2026, we observed DarkVigil implants being launched by SGTool.exe, a Sogou Input Method component. Further investigation revealed that a request belonging to the application's branded-word promotion mechanism had been hijacked to deliver a malicious configuration. This configuration instructs the binary to place payloads in specific locations where they can be executed through Sogou Input Method's existing workflows. SGTool.exe is a legitimate Sogou Input Method component that functions as a multipurpose task dispatcher.”

Tencent fixed the vulnerability in version 16.10

Sogou Input Method, also known as Sogou Pinyin, is one of the most widely used Chinese input method editors for typing Chinese characters on computers and mobile devices. The application has previously featured in threat intelligence research. Shortly after uncovering the operation, ESET contacted the Tencent Security Response Center to report the abuse and share its findings. Tencent responded quickly and released a patch addressing CVE-2026-120422. Version 16.10 resolves the issue by moving the affected HTTP requests to HTTPS. By enforcing TLS certificate validation, this change reduces the risk of malicious configuration delivery through DNS hijacking.

Tracking DarkVigil and SlippyNunchucks

ESET Research has been tracking the DarkVigil toolset, also known as FDMTP, since early 2025. The name DarkVigil comes from Vigil, the internal name seen in the malware framework's library references. ESET also identified the web administration panel used to manage data exfiltrated by the implant. The panel features a logo bearing the Vigil name.

SlippyNunchucks has been active since at least 2023, with its cyberespionage activities centred on deploying and using the DarkVigil toolset, also known as FDMTP. The group primarily targets organisations and Chinese-speaking individuals in South and East Asia. At times it has also targeted victims in Europe, including individuals in Germany, Russia, the United Kingdom and Austria. In ESET telemetry, DarkVigil-related activity forms a distinct cluster pointing to an APT group whose operations revolve around deploying and using this toolset. ESET tracks this threat actor as SlippyNunchucks. Contrary to public reports attributing DarkVigil to Mustang Panda, also known as Twill Typhoon, ESET telemetry revealed no overlap between DarkVigil-related activity and Mustang Panda activity.

Sources: ESET Türkiye and ESET press release.