SlippyNunchucks abuses Sogou keyboard to deliver malware

A China-aligned group named SlippyNunchucks has exploited Sogou Input Method’s brand-promotion mechanism to deliver the DarkVigil toolset to users across six countries, turning legitimate app traffic into a malware distribution channel. ESET researcher Anh Ho attributed the activity to at least 15 September 2023 and described DarkVigil, also known as FDMTP, as a modular .NET toolkit with more than 20 plugins.

ESET assessed with high confidence that the operation is tied to a nation-state surveillance effort aligned with Chinese government interests. The campaign began on 1 July 2026, when users of Sogou Input Method—Tencent’s popular Chinese-language keyboard—began receiving DarkVigil implants, initially indicated by the breadth of affected victims.

The attack relied on a hijacked Sogou traffic flow: a Sogou component fetched a brand-promotion configuration over unencrypted HTTP, with DNS hijacking redirecting requests to attacker-controlled servers that returned a malicious configuration. This enabled the downloader to install DarkVigil and place it where Sogou components would run, giving persistence. ESET noted uncertainty about where the DNS manipulation occurred, proposing possibilities such as compromised routers or ISP-level interception.

Victims were in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, including a multinational gambling organisation operating from Sri Lanka, the Philippines and Hong Kong, an internet café in Dubai and a university student in Denmark, though ESET did not provide a victim count.

Tencent fixed the flaw by upgrading Sogou Input Method to version 16.10 in late October, switching affected requests to HTTPS with certificate pinning; however, the downloader reportedly still did not validate downloaded file types or restrict where files are saved. Where the DNS hijack occurred remains unknown.