Security firm ESET reports an espionage operation by a group it calls SlippyNunchucks, starting July 1, 2026. The group abused the fact that the Windows version of Sogou Input Method, a popular Chinese keyboard from Tencent, fetched settings over unencrypted HTTP. When the attackers tampered with DNS resolution, the software received a malicious configuration that told it to download and launch the DarkVigil backdoor.
According to ESET, the operation targeted organizations and Chinese speakers in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. The group, active since at least September 2023, has abused other Chinese apps before, and in August a supply chain compromise of QuickFox VPN was reported. ESET assesses it as a state surveillance effort serving the Chinese government's interests.
What to do: Tencent fixed the flaw (CVE-2026-120422) in version 16.10, released October 29, which moved the requests to HTTPS. Anyone using Sogou Input Method on Windows should make sure it is on that version or later.