Imagine installing a typing application on your computer. It works perfectly, helps you write faster, and does exactly what it promises. Nothing suspicious, no strange pop-ups, and no obvious reason to worry.
Now imagine that the same application starts downloading malware because hackers found a way to manipulate one of its legitimate features.
That is what cybersecurity researchers at ESET uncovered in a cyber espionage campaign involving Sogou Input Method, a popular Chinese typing application owned by Tencent.
The attackers, identified as a China-aligned threat group called SlippyNunchucks, exploited insecure network communications to distribute DarkVigil, a modular malware toolkit designed for surveillance.
And perhaps the most unsettling detail is that the application itself was legitimate.
How a Trusted Typing App Became an Attack Vector
Sogou Input Method is one of China’s most widely used tools for typing Chinese characters. Originally developed by Sogou and now owned by Tencent, the software has been part of everyday computing for years.
Its popularity made it an attractive target. Rather than persuading victims to download suspicious software, the attackers exploited a feature already built into the application.
According to ESET, the campaign was observed beginning on July 1, 2026, targeting organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
The researchers also linked SlippyNunchucks to cyber espionage operations dating back to at least September 2023.
What makes this case particularly interesting is that the attackers did not need to create a fake version of Sogou Input Method.
They found a way to interfere with how the legitimate software communicated with remote servers.
The DNS Hijacking Trick Behind the Attack
The vulnerability involved a feature used by Sogou Input Method to retrieve configuration information for its branded vocabulary promotion system.
Normally, a legitimate component called SGTool.exe connects to Sogou’s servers to download configuration data associated with the application’s vocabulary features.
There was one significant problem: some of those requests used HTTP instead of encrypted HTTPS connections.
The attackers exploited that weakness through DNS hijacking.
DNS, or Domain Name System, is the technology that translates website and server names into IP addresses. When that process is manipulated, a device can be directed toward a malicious server instead of its intended destination.
In this campaign, the attackers controlled DNS responses in affected environments, redirecting certain Sogou requests to infrastructure under their control.
Those servers returned malicious configuration files that instructed SGTool.exe to download additional components.
The payload included a legitimate Adobe executable and a malicious DLL containing DarkVigil.
By exploiting a technique known as DLL sideloading, the attackers could execute their malware through software components that appeared legitimate.
In simpler terms, the application was following instructions, but those instructions were no longer coming from the trusted source it expected.
ESET has not established exactly where the DNS manipulation occurred. Compromised routers, malicious DNS configurations, and interception at the internet service provider level remain possible explanations.
That uncertainty matters because it shows how difficult it can be to identify the precise entry point of a sophisticated cyberattack.
DarkVigil: The Malware Designed for Surveillance
The attack was not simply an attempt to disrupt computers. Its purpose was espionage.
DarkVigil, also known as FDMTP, is a modular malware toolkit built on the .NET framework. It includes more than 20 known plugins that can support different activities, including information collection and maintaining access to compromised systems.
The malware uses a communication protocol called Duplex Message Transport Protocol, or DMTP, to interact with attacker-controlled servers.
This architecture allows operators to deliver additional plugins and manage infected systems remotely.
According to The Hacker News, the campaign was associated with SlippyNunchucks, a threat group that ESET assesses to be operating in alignment with Chinese government interests.
One notable target was a multinational organization operating Chinese-language online gambling platforms across parts of Asia.
ESET considers the group’s activities consistent with a state-aligned surveillance operation.
However, that assessment should not be confused with publicly established proof that Chinese government officials directly ordered these specific attacks.
In cybersecurity investigations, technical attribution and identifying who ultimately authorized an operation are not always the same thing.
Tencent Released a Security Fix
There is some good news. After ESET reported the vulnerability, Tencent addressed the issue in Sogou Input Method version 16.10, released at the end of October 2026.
The vulnerability, tracked as CVE-2026-120422, was mitigated by moving the affected HTTP requests to HTTPS and introducing certificate validation protections.
This change helps prevent attackers from replacing legitimate configuration responses with malicious instructions through the same DNS hijacking technique.
Users running affected versions of the Windows application should update to version 16.10 or later.
However, updating vulnerable software does not automatically remove malware that may already be present on a compromised system.
Organizations with evidence of suspicious activity should investigate affected devices and review relevant security indicators.
Interestingly, this was not the first security incident involving Sogou Input Method in 2026.
In September, Gen Digital disclosed a separate vulnerability involving the application that had been exploited to distribute another backdoor called GRAYRABBIT.
The incidents involved different vulnerabilities and attack methods, but they illustrate a broader problem: popular applications can attract attackers who search for weaknesses in features that users rarely notice.
What This Attack Reveals About Everyday Cybersecurity
Most people associate malware infections with obvious mistakes.
Downloading pirated software, opening suspicious attachments, clicking unfamiliar links, or installing applications from questionable websites. Those risks are real, of course.
But the Sogou incident demonstrates that even legitimate software can become an attack vector when attackers exploit weaknesses in its underlying design.
That changes the conversation. An application does not have to be malicious by design to become dangerous under certain conditions.
And downloading software from an official source, while important, does not guarantee that every component is free from vulnerabilities.
For everyday users, keeping applications updated remains one of the simplest ways to reduce exposure.
For businesses, the lesson goes further. Monitoring network communications, maintaining software inventories, and investigating unusual activity from trusted applications can be just as important as blocking unknown programs.
Developers also have something to learn from this case.
Features that seem secondary, such as downloading icons or retrieving configuration files, still need strong security controls.
After all, a mechanism designed to improve a typing application’s vocabulary became the entry point for an international espionage campaign.
The Real Threat Is Not Always the Software You Install
The Sogou Input Method incident is a reminder that modern cyberattacks do not always begin with a suspicious download.
Sometimes, attackers find ways to manipulate the ordinary behavior of legitimate applications.
The software may continue working. Its interface may look familiar. And the user might have no idea that something unusual is happening behind the scenes.
That is what makes these attacks particularly difficult to recognize. The real question is no longer simply whether we can trust the applications installed on our computers.
It is whether we can recognize when something trustworthy starts behaving in ways it was never supposed to.
