SlippyNunchucks Exploits Sogou Input Method to Distribute DarkVigil Malware

• •SlippyNunchucks APT group exploits Sogou Input Method to distribute malware.
• •The attack targets Chinese-speaking users across multiple countries in Asia and Europe.
• •Tencent has released a patch for the CVE-2026-120422 vulnerability exploited in this campaign.

ESET has reported that the SlippyNunchucks APT group is using a DNS hijacking operation to distribute DarkVigil malware through the Sogou Input Method, a popular Chinese input application. The attack exploits a vulnerability in the application’s branded vocabulary promotion mechanism, allowing the threat actor to deploy malicious payloads. This operation primarily targets Chinese-speaking users in regions including Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. Tencent, the developer of Sogou Input Method, has acknowledged the issue and released a patch (version 16.10) to address the CVE-2026-120422 vulnerability. The vulnerability was reported to Tencent on September 11, 2026, and the patch was made available on October 30, 2026. ESET's telemetry indicates that the attack vector leverages insecure HTTP communications within the application. The DarkVigil toolset has been under observation since 2025, with previous attacks linked to the QuickFox supply chain compromise.