Sogou Input Method Backdoor: Hijacked Updates Installed DarkVigil Malware (CVE-2026-120422), and How to Check Your PCs

A China-aligned hacking group has been abusing the update traffic of Sogou Input Method, a widely used Chinese-language keyboard app for Windows, to quietly install a backdoor called DarkVigil, according to research ESET published on November 4, 2026. If anyone using your company's Windows PCs types Chinese, whether staff, contractors or a branch office in Asia, an older copy of this app is a way into your network until it is updated to version 16.10.

The flaw is tracked as CVE-2026-120422, and Tencent, which owns Sogou, has released a fix. This post covers what ESET confirmed, what is still unknown, and how to check your machines this week.

What happened with the Sogou Input Method backdoor

ESET researcher Anh Ho found that a Sogou component called SGTool.exe downloads a configuration file over plain, unencrypted HTTP. The file comes from config.pinyin.sogou[.]com and controls the icons for Sogou's branded word lists. ESET counted 20 HTTP endpoints like this on that host.

The request is not encrypted, so anyone who controls how a victim's computer looks up that domain name can send back a reply from their own server. ESET says the group it calls SlippyNunchucks did this:

1. DNS lookups for the Sogou configuration domain were pointed at attacker staging servers.
2. The fake configuration told Sogou to download two files: a renamed, genuinely signed Adobe program (biz_helper.exe) and a malicious libcef.dll containing DarkVigil.
3. The attackers edited the MD5 checksum fields in the configuration to match their files, so Sogou's own integrity check passed.
4. The Adobe program was saved as SogouComMgr.exe in Sogou's Components folder, where it loads the malicious DLL placed next to it. This trick is called DLL sideloading.

The result looks like a trusted Sogou process starting a signed program. That is why this kind of attack can get past a quick look.

What is confirmed

From ESET's report and the official CVE record:

• The CVE: CVE-2026-120422, assigned by ESET and published November 4, 2026. The record says Sogou Input Method for Windows uses unencrypted HTTP in SGTool.exe, so an attacker who can manipulate network traffic can swap in a configuration that downloads files leading to code execution.
• Severity: CVSS 4.0 score of 8.9, rated High.
• Affected: all Windows versions of Sogou Input Method before 16.10.
• Fixed: version 16.10, which moves the affected requests to HTTPS and turns on certificate pinning.
• Timeline: ESET reported the issue to Tencent Security on September 11, 2026, and Tencent acknowledged it on September 21. ESET's report gives the 16.10 release date as October 29 in one place and October 30, 2026 in another.
• Activity: ESET saw DarkVigil launched by SGTool.exe from July 1, 2026, three days after QuickFox, another app the group had abused in a supply chain compromise, released a clean version.
• Who was hit: organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. ESET also names a gambling organization operating in Sri Lanka, the Philippines and Hong Kong among the group's notable victims.
• Attribution: ESET assesses with high confidence that SlippyNunchucks is China-aligned and has been active since at least September 15, 2023. It says it found no overlap with Mustang Panda, a group some earlier public reporting linked to DarkVigil.

What is not known

• Where the DNS hijacking happens. ESET says the point where DNS is manipulated "remains unknown." It lists possibilities: routers with altered DNS settings, routers carrying a DNS-hijacking implant, or interception at the internet provider level. None of these is confirmed.
• How many victims there are. ESET lists countries, not a count.

The first gap matters. If compromised routers are the cause, the problem is not just one app. It is the network equipment, and any other software on that network that updates over plain HTTP is exposed too. We covered how hijacked routers become attack infrastructure in Volt Typhoon Silent Train.

What is DarkVigil malware

ESET describes DarkVigil, also known as FDMTP, as "a modular .NET toolset" with more than 20 known plugins. The main implant runs and coordinates plugins that set up persistence or collect data, and it talks to its command server using encrypted messages over a protocol called DMTP. Put simply: once it is on a PC, the operators can add whatever abilities they need and send data out. ESET detects the implants as Win64/Agent.KSV and MSIL/DarkVigil_AGen.D.

ESET says the same group has also abused other apps, including QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to.

Why this matters for a business network

Input method apps are easy to forget. An employee who needs to type Chinese installs one, it runs in the background at every login, and it rarely shows up in a software inventory. It also updates itself, and that update channel is exactly what was abused here.

For a company, the risk is a trusted-looking program on a work laptop that can download and run code. From there an attacker can collect data, take saved logins and work toward shared drives and email. Laptops that travel or connect from hotel, home or branch networks you do not manage face the most risk, because DNS could be tampered with on those networks.

It is also a reminder that an app that updates itself is not automatically safe. Our post Updated Is Not the Same as Patched explains why, and Who Is Patching the Software That Runs Your Business? covers who should own this work.

What to do this week

ESET's report also lists SHA-1 file hashes your security vendor can search for. If you find a match, disconnect the PC from the network, reset passwords that were used on it, and have it examined before it goes back into use.

Sogou Input Method questions people are asking

Is Sogou Input Method safe to use?

Version 16.10 and later fix the flaw ESET found by switching to HTTPS with certificate pinning. Older versions are affected. If staff need it, keep it current. If they do not, remove it.

What is CVE-2026-120422?

It is the flaw where Sogou Input Method for Windows fetches configuration over unencrypted HTTP in SGTool.exe. It is rated 8.9, High, under CVSS 4.0 and is fixed in version 16.10.

What is DarkVigil?

DarkVigil, also called FDMTP, is a modular .NET backdoor toolset with more than 20 plugins. ESET attributes this campaign to the China-aligned group SlippyNunchucks.

Does the Sogou hack affect businesses outside Asia?

The confirmed victims in this campaign are in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. The flaw is in the app itself, though, so any Windows PC running a version before 16.10 is exposed if an attacker can tamper with its DNS.

How do I know if a PC was infected?

Check the files, domains and IP addresses in the table above, and run a full scan with current security software. A clean scan on an updated machine is a good sign, but the logs tell you whether it was ever contacted.

Was the Sogou DNS hijacking done through routers?

Not confirmed. ESET says routers or an internet provider are possibilities but the actual method is unknown.

The bigger lesson

Any software that fetches instructions over plain HTTP is trusting the network to tell the truth, and attackers who control the network will not. Know what is installed on your machines, including the small helper apps nobody thinks about, and check how each one updates.

To review your endpoints and network, see security hardening or get a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: ESET Research: SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware; CVE-2026-120422 record.