Covered by 3 outlets — first reported by ESET WeLiveSecurity, Nov 4, 09:55 UTC
SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
MentionsMicrosoftMicrosoft WindowsESET
Summary
ESET Research says a China-aligned group it calls SlippyNunchucks hijacked internet lookups (DNS requests) used by the Windows version of Sogou Input Method, which fetches content over unencrypted HTTP. The hijacking was used to deliver a backdoor called DarkVigil, also known as FDMTP, in what ESET describes as a surveillance campaign. The activity was observed starting July 1, 2026, and targeted organizations.
AI summary by the SecurityTabs newsroom, checked against ESET WeLiveSecurity, The Hacker News, Infosecurity Magazine. Read the outlets below for the full story.
Continue reading
3 outlets, in the order they reported it.
ESET WeLiveSecurityFirst report
SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
ESET Research analyzes a DNS hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method
The Hacker News
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign…
Infosecurity Magazine
China-Aligned Group Abuses Sogou Input Method to Deliver Malware
SlippyNunchucks used DNS hijacking to turn Sogou brand promotions into a malware channel
Explained
The technology and terms in this story. Learn more