China-Aligned Threat Actor Exploits Sogou Input Method Vulnerability for DarkVigil Deployment

A China-aligned threat actor, SlippyNunchucks, exploited insecure HTTP communications in the Sogou Input Method to hijack DNS requests and deploy the DarkVigil backdoor for surveillance. The campaign, active since July 1, 2026, targeted organizations as part of a broader cyber espionage operation.

A China-aligned threat actor known as SlippyNunchucks has been attributed to a Domain Name System (DNS) hijacking operation abusing insecure HTTP communications in Windows versions of Sogou Input Method as part of a surveillance campaign designed to deploy an implant called DarkVigil (aka FDMTP).

The campaign, observed starting July 1, 2026, is assessed to have targeted organizations and

Read original article