A China-aligned hacking group has hijacked a popular Chinese keyboard app to secretly install spyware on users' computers, ESET says — without exploiting a software flaw at all.

SlippyNunchucks, as ESET tracks the group, abused Sogou Input Method, Tencent's keyboard software. ESET's 4 November research says the campaign began on 1 July 2026 and reached organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. No victim count has been published.

A fake keyboard update

The attack turned on a small piece of the app's plumbing: a Sogou component, SGTool.exe, fetches a configuration file for a "brand promotion" feature over plain, unencrypted HTTP. On victim networks, the attackers tampered with DNS so the request went to their server instead of Sogou's own.

It told the app to download two files: a genuine, signed Adobe helper program and the DarkVigil implant disguised as an ordinary library file. The attackers altered the checksums so Sogou's own integrity check accepted the downloads. The Adobe program was placed where Sogou's own workflows would run it, and when it started it loaded the malware alongside it.

A backdoor with 20-plus plugins

DarkVigil, also known as FDMTP, is a modular .NET toolset with more than 20 plugins, talking to operators over a protocol called DMTP. ESET has tracked it since early 2025; SlippyNunchucks has abused several other Chinese applications the same way, including QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to.

Where the DNS tampering happens is still unknown: ESET says compromised routers, a DNS-hijacking implant on routers, or interception at the internet-provider level are all possible.

Tencent fixed the weakness in Sogou Input Method 16.10, released on 29 October, by moving the affected requests to encrypted HTTPS. The flaw is CVE-2026-120422, rated 8.9 out of 10. Users should update to 16.10 or later.

Sources: ESET WeLiveSecurity, SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware, 4 November 2026; The Hacker News, 4 November 2026; GBHackers, 5 November 2026.