Chinese Keyboard App Update Feature Hijacked to Spread Spyware in Six Countries

A China-aligned group has turned the brand-promotion feature of Sogou Input Method, a popular Chinese-language keyboard app owned by Tencent, into a way to deliver malware. ESET researcher Anh Ho named the group SlippyNunchucks and traced its activity to at least September 15, 2023. ESET assessed with high confidence that it is linked to a nation-state surveillance effort aligned with Chinese government interests. The campaign began on July 1, 2026, and delivered a toolset called DarkVigil.

The attack relied on a weak point: a Sogou component fetched its promotion settings from a Sogou server over unencrypted HTTP. DNS hijacking redirected those requests to attacker-controlled servers, which returned a malicious configuration. The app then downloaded DarkVigil and placed it where Sogou's own components would run it, giving the malware persistence. ESET does not know where the DNS manipulation happened. Possibilities include routers with malicious DNS settings, compromised routers, or interception at ISP level.

Victims were in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman. They included a multinational gambling organisation, an internet café in Dubai and a university student in Denmark. ESET gave no victim count. DarkVigil, also known as FDMTP, is a modular .NET toolset with more than 20 plugins. ESET tracks the group separately from Mustang Panda, despite an earlier Darktrace link.