SlippyNunchucks Hijacks Sogou Input Method to Distribute Malware
SlippyNunchucks Hijacks Sogou Input Method to Distribute Malware
At ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025. Across the campaigns we have analyzed, one behavior has remained consistent: DarkVigil implants are typically deployed through popular Chinese applications. By abusing these applications, the SlippyNunchucks threat actor has been able to reach Chinese-speaking users across Asia and Europe. Shortly after the QuickFox supply-chain compromise ended, SlippyNunchucks shifted to abusing Sogou Input Method to deploy DarkVigil.
On July 1st, 2026, we continued to observe DarkVigil implants being launched, this time by the Sogou Input Method component SGTool.exe. Further investigation revealed that a request, which belongs to the application’s branded vocabulary promotion mechanism, was hijacked to serve a malicious configuration. This configuration instructs the binary to place payloads in selected locations that enable their execution through Sogou Input Method’s existing workflows. We uncovered a SlippyNunchucks DNS hijacking operation, abusing Sogou Input Method’s use of insecure HTTP communications. The point at which DNS manipulation occurs remains unknown, leaving the hijacking vector unresolved. Sogou Input Method (also known as Sogou Pinyin) is one of the most widely used Chinese input method editors (IMEs) for typing Chinese characters on computers and mobile devices.
In our telemetry, we observed that this operation targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. After uncovering the operation, we contacted the Tencent Security Response Center to report the abuse and share our findings. Tencent responded promptly and released an update to address the issue. The vulnerability disclosure timeline indicates: ESET Research reported the security weakness to the Tencent Security team on 2026-09-11, Tencent responded and acknowledged the issue on 2026-09-21, Tencent addressed the issue in version 16.10 on 2026-10-30, and ESET CNA issued a CVE ID for the vulnerability (CVE-2026-120422) on 2026-11-02. On October 29th, 2026, Tencent released version 16.10, which addresses the issue by migrating the affected HTTP requests to HTTPS.
SlippyNunchucks is a China-aligned threat actor that has been active since at least September 15th, 2023. Its cyberespionage activities center on the deployment and operation of the DarkVigil toolset (also known as FDMTP). DarkVigil is a modular .NET toolset that includes the DarkVigil implant and more than 20 known plugins. The toolset is built on the Vigil malware framework, which is built on the TouchSocket networking framework, implementing DMTP, a network protocol DarkVigil uses for C&C communications. We assess with high confidence that SlippyNunchucks is associated with a nation-state surveillance effort aligned with the interests of the Chinese government.