China-aligned hackers abused Sogou keyboard updates to install DarkVigil malware
THREAT ACTORDarkVigilredteam/daily · 1 source
- Severity
- High
- Sources
- 1
What happened
A China-aligned espionage actor, tracked by ESET Research as SlippyNunchucks, abused the update traffic of Sogou Input Method to covertly install the DarkVigil implant. ESET published its findings on 4 November 2026. Tencent, which owns Sogou, has patched the flaw in version 16.10. The articles do not give a CVE identifier or the affected version range, so defenders should confirm the installed Sogou version and review update-channel traffic for signs of compromise.
For security analysts · Written by AI from 1 source · Wrong?
What to do
- Update Sogou Input Method to version 16.10 or later.
- Check whether Sogou Input Method is installed on your devices and confirm its version.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
GBHackers
Who and what is in it
Threat actors
Malware
Companies
Products