A China-aligned espionage group has been planting spyware on computers across Asia by hijacking a routine request from Sogou Input Method, one of the most widely used Chinese typing tools. ESET Research reports that the operation abused the app's habit of fetching a configuration file over plain, unencrypted HTTP.
ESET calls the group SlippyNunchucks and its modular .NET toolset DarkVigil (also known as FDMTP). Since July 1, 2026, ESET's telemetry has seen victims in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka receive the implant while using Sogou. Tencent, which owns Sogou, fixed the weakness in version 16.10 at the end of October, and ESET's CNA assigned it CVE-2026-120422.
A green sprout icon that delivered a backdoor
The hijacked request belongs to Sogou's Startup Brand Support Program, which adds startup brand names to the typing suggestions with a small green sprout icon. A Sogou component, SGTool.exe, asks config.pinyin.sogou[.]com for a configuration describing which icons to download. Normally it gets back an instruction to fetch the sprout image. ESET found 20 endpoints on that host that SGTool.exe reaches over HTTP rather than HTTPS, including this one.
On victims' networks, DNS for that Sogou host pointed at attacker staging servers instead. They returned a malicious configuration, encrypted the same way as the real one and with matching checksums, that told Sogou to download a legitimate signed Adobe helper and a malicious libcef.dll and save them where Sogou's own component manager would launch them. The Adobe binary then side-loads the DLL, running DarkVigil. Because it rides on Sogou's existing component-loading workflow, the implant gets persistence without a separate mechanism.
ESET says it does not know where the DNS manipulation happens. It lists compromised routers with malicious DNS settings, router implants that intercept DNS, or interception at the ISP level as possibilities.
Who SlippyNunchucks watches
ESET has tracked the group since 2025 and says it has been active since at least September 2023. It previously spread DarkVigil through a compromise of the QuickFox supply chain, and switched to Sogou three days after QuickFox shipped a clean version. It has also abused QingTalk, MiYunChat, SoftCam and tawk.to to reach Chinese-speaking users in Asia and, occasionally, Europe.
ESET assesses with high confidence that the group serves a surveillance effort aligned with the Chinese government. Its victims include an operator of Chinese-language betting platforms in Sri Lanka, Hong Kong and the Philippines, which ESET says fits Beijing's crackdown on gambling and scam operations abroad. ESET also disputes public reporting that ties DarkVigil to Mustang Panda, saying its telemetry shows no overlap.
Update Sogou to 16.10 and check DNS
Users and administrators should update Sogou Input Method to version 16.10 or later, which moves the affected requests to HTTPS with certificate validation. Because the hijack happens upstream, also verify router DNS settings and firmware, and hunt for an unexpected SogouComMgr.exe or libcef.dll under the Sogou Components folder.
Indicators
- Staging server: 47[.]239[.]250[.]102
- Staging server: 47[.]237[.]122[.]175
- Attacker domain: sogou-cdn[.]com
An input method sees everything a user types, which makes it an obvious prize, and a single unencrypted request was all it took to turn one into a delivery channel.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.