A China-aligned threat actor has found a quiet way into thousands of Windows machines across Asia: not through a software exploit, but through one of the region’s most widely used typing tools. Security researchers at ESET say a group they track as SlippyNunchucks has been hijacking update traffic from Sogou Input Method, a hugely popular Chinese-language keyboard app owned by Tencent, to plant a custom backdoor called DarkVigil.

The campaign has been running since at least July 2026 and has reached victims in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, according to ESET’s writeup on WeLiveSecurity. What makes it notable is the attack path: no vulnerability in Sogou itself was exploited. Instead, the attackers abused the fact that some of the app’s background network requests still travel over unencrypted HTTP rather than HTTPS.

How a Typing App Became a Delivery Mechanism

Sogou includes a small helper process, SGTool.exe, that periodically checks in with a Tencent-controlled server for a “brand promotion” settings file — normally just instructions for which icon to display inside the app. Because that check-in travels in the clear, an attacker who can manipulate DNS resolution for the victim’s network can redirect the request to infrastructure they control.

Once that redirection succeeds, SlippyNunchucks’ servers return a forged settings file that tells Sogou to fetch two files instead of a harmless image: a legitimate, digitally signed Adobe helper binary, and the DarkVigil implant disguised as a Windows library file. The attackers also altered the checksums Sogou uses to validate downloads, so the app’s own integrity checks waved the malicious files through.

The persistence trick is what elevates this from a one-time infection to a standing foothold. By renaming the real Adobe binary and placing it where Sogou expects to find one of its own components, the attackers exploit a technique known as DLL side-loading: every time the trusted Adobe program runs, it unwittingly loads the malicious file sitting next to it, giving the intruders durable access without needing a separate persistence mechanism. A backup copy is stashed in a secondary folder in case the primary one is overwritten by a future update.

DarkVigil’s Reach and the Group Behind It

ESET says it has actually been tracking DarkVigil — also known by the alias FDMTP — since early 2025, initially suspecting a software exploit was responsible for infections spreading across so many countries before identifying the DNS-hijacking delivery method. The malware itself is a modular .NET toolkit with more than twenty known plugins, communicating with its operators through a custom protocol that pushes new capabilities down to infected machines and stores them in the Windows registry. Stolen data is managed through a web control panel the researchers found branded “Vigil.”

SlippyNunchucks has reportedly been active since at least September 2023 and has run similar hijacking plays against other Chinese-language software, including QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to. ESET says the group’s targeting pattern points toward state-aligned interests, with particularly heavy surveillance of a company operating Chinese-language betting platforms across Sri Lanka, Hong Kong and the Philippines, alongside more incidental victims such as an internet café in Dubai and a student in Denmark. Notably, ESET says it does not attribute the activity to the well-known Mustang Panda group, despite some public reporting suggesting a link.

Tencent has patched the underlying weakness in Sogou version 16.10, tracked as CVE-2026-120422, by moving the vulnerable check-in process to HTTPS. Organizations running Sogou Input Method should prioritize this update.

What Defenders Should Do

Because the attack doesn’t rely on a flaw in Sogou’s code, patching the app closes the door going forward but doesn’t retroactively clean an already-compromised network. Security teams are advised to:

• Update Sogou Input Method to version 16.10 or later across all managed endpoints
• Audit router and DNS infrastructure for unauthorized changes, since the initial hijacking point remains unconfirmed and could involve compromised routers or ISP-level interception
• Hunt for unusual Adobe-branded files sitting inside Sogou’s installation directories, a strong indicator of the side-loading technique
• Monitor for connections to known DarkVigil infrastructure and bootstrap domains identified in ESET’s published indicators of compromise

The campaign is a reminder that supply-chain-style attacks don’t always require breaking into a vendor’s build pipeline — sometimes intercepting a single unencrypted update check is enough to turn a trusted, everyday application into a quiet espionage tool.