Sogou Input Method
ProductAm I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Malware reported by Infosecurity MagazineChina-aligned group abuses Sogou Input Method to deliver malware
- Activity reported by The Hacker NewsChina-aligned hackers hijack Sogou Input Method DNS requests to deploy DarkVigil backdoor
Recent news
China-aligned group abuses Sogou Input Method to deliver malware
SlippyNunchucks, a China-aligned threat group, used DNS hijacking to turn brand promotions for Sogou Input Method into a malware delivery channel. The campaign abused the trust placed in a legitimate input method product's advertising.
China-aligned hackers hijack Sogou Input Method DNS requests to deploy DarkVigil backdoor
SlippyNunchucks, a China-aligned threat actor, is abusing insecure HTTP traffic in the Windows version of Sogou Input Method to hijack DNS requests. The redirected traffic is used to deploy the DarkVigil implant (also known as FDMTP) as part of a surveillance campaign observed from 1 July 2026. The article describes organisations being targeted but is cut off before listing the victims.