China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

thehackernews.com Nov 4, 2026

China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

Curated by Shubham · TechCapsules · Nov 4, 2026

AI-summarised brief · reviewed before publication

A China‑aligned threat actor, SlippyNunchucks, hijacked DNS requests in the Sogou Input Method to deploy the DarkVigil backdoor, targeting Chinese‑speaking users across Asia and Europe. The attack began July 1, 2026, exploiting insecure HTTP traffic to serve malicious configurations that download additional payloads via SGTool.exe. ESET identified the operation as a distinct intrusion set, noting its use of a modular .NET framework and DMTP for command‑and‑control. Tencent patched the vulnerability (CVE‑2026‑120422) on October 29, 2026, switching to HTTPS.

💡 Why It Matters

· The incident demonstrates how nation‑state actors can weaponize widely used language tools to conduct covert surveillance, bypassing traditional security measures.
· It underscores the need for secure communication protocols in everyday applications.

Capsules Cybersecurity

Read full article on thehackernews.com

Security Bite: The record $6.3B Binance heist started with a fake Homebrew…

Last week, hackers stole $6.3 billion from Binance wallets, the largest financial heist ever. Binance froze nearly $3 billion, but the breach still dominated headlines. Security researcher Christopher Lopez and others suspect the attack began on a Mac, echoing the $1.5 billion Bybit theft that also started on a developer’s Mac. Mac users, especially DevOps and crypto professionals, have faced increasing malware and social‑engineering attacks, raising concerns about platform security.

💡 The incident underscores how even high‑profile exchanges remain vulnerable to sophisticated, platform‑specific attacks, prompting a reevaluation of security practices across the crypto ecosystem.

thehackernews.com · Nov 5

5 Active Cyber Threats That Put US Enterprises at Risk in October…

In October 2026, U.S. enterprises faced five active cyber threats that leveraged trusted platforms and legitimate authentication flows. SkyW4lker, a phishing kit, used Microsoft’s device‑code authentication to gain account access without passwords, with 618 sandbox analyses identified, 46% from the U.S. Researchers employed ANY.RUN’s Related Threat Context to link SkyW4lker to the Gabagool kit, uncovering infrastructure across multiple sectors. The article outlines detection tactics, including restricting device‑code use, leveraging sandbox insights, and tightening AI‑related downloads to reduce MTTR and prevent credential theft.

💡 By exposing how attackers hijack legitimate authentication, the report equips security teams with actionable tools to cut investigation time and stop credential‑stealing campaigns before they breach critical systems.

thehackernews.com · Nov 5

Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find…

A critical vulnerability can traverse multiple security tools yet remain unmitigated because essential context—ownership, reachability, existing protections, and business impact—is often missing. Each gap forces additional investigations, handoffs, and delays. An effective exposure management platform must link discovery to clear prioritization, actionable response, and proof of remediation, a process defined as Continuous Threat Exposure Management (CTEM). The article outlines five tests to evaluate whether a platform supports CTEM across infrastructure, identities, sensitive data, and external threats. It highlights the role of Cyber Asset Attack Surface Management (CAASM) in consolidating disparate asset records and exposing stale data, and External Attack Surface Management (EASM) in revealing shadow IT, exposed services, and brand impersonation. Integrating CAASM and EASM creates a unified view that drives accurate prioritization, validation, and rapid remediation.

💡 Without a unified platform that bridges internal and external asset intelligence, organizations waste time reconciling inconsistent data, leaving high‑risk exposures open far longer than necessary.

gamesradar.com · Nov 5

Stellar Blade studio confirms previous game Nikke was hacked and the launcher…

Shift Up, the studio behind Stellar Blade, confirmed a cyberattack on the PC launcher of its game Goddess of Victory: Nikke. On November 4, the official account announced that third‑party tampering had altered the launcher’s script files. The company is investigating the extent of the impact and collaborating with Level Infinite to develop a permanent fix. Shift Up apologized for the disruption and pledged to release further updates on mitigation measures.

💡 The incident underscores the vulnerability of popular game launchers to external tampering, potentially exposing user data and game integrity. It also highlights the rapid response required by developers to maintain player trust during security breaches.

thehackernews.com · Nov 5

OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run

OpenAI disclosed a five‑stage AI pipeline that, over a 30‑hour run in mid‑October 2026, used an upcoming cyber‑focused model to dynamically reproduce 1,724 Linux kernel vulnerabilities and generate 948 working local‑privilege‑escalation (LPE) exploits for a popular Linux distribution. The prototype examined 2,308 candidate findings, produced proof‑of‑concept code for 291 information‑leak bugs, and identified at least ten novel exploitation techniques. The operation cost $1,213,430 in API credits, averaging $1,279 per LPE exploit. OpenAI highlighted the dual‑use nature of such technology, noting that while AI can accelerate patch creation and reduce exposure windows, the same tools are increasingly accessible to malicious actors, amplifying the speed and volume of zero‑day discovery across the industry.

💡 The ability to mass‑produce functional exploits at a predictable cost forces defenders to rethink patch cycles and automation, lest they fall behind a rapidly scaling threat landscape.

techcrunch.com · Nov 4

Hackers stole DreamHost customer files and inboxes during months-long attack

DreamHost disclosed a months‑long cyberattack that began in August, during which hackers accessed customer emails, credentials, and session tokens via an unspecified vulnerability in its file manager. The breach was revealed after a multi‑day outage that forced password resets. DreamHost confirmed that less than 10% of its 400,000 paying customers were affected, but did not provide a precise figure. The company stated the vulnerability was unrelated to recent PHP software flaws and is still investigating why the intrusion went undetected for weeks.

💡 The incident underscores the growing risk of session‑token theft, enabling attackers to impersonate users without passwords. It also highlights the need for web hosts to monitor and patch file‑management systems promptly to protect customer data.