thehackernews.com
China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor
A China‑aligned threat actor, SlippyNunchucks, hijacked DNS requests in the Sogou Input Method to deploy the DarkVigil backdoor, targeting Chinese‑speaking users across Asia and Europe. The attack began July 1, 2026, exploiting insecure HTTP traffic to serve malicious configurations that download additional payloads via SGTool.exe. ESET identified the operation as a distinct intrusion set, noting its use of a modular .NET framework and DMTP for command‑and‑control. Tencent patched the vulnerability (CVE‑2026‑120422) on October 29, 2026, switching to HTTPS. [...]