Hijacked Software Updates Spread DarkVigil Spyware Through Popular Chinese Apps

A China-aligned threat group known as SlippyNunchucks has been linked to a surveillance campaign that hijacked Domain Name System (DNS) requests from the Windows version of Sogou Input Method. According to ESET, the attackers took advantage of insecure HTTP communications in the app to deliver an implant called DarkVigil, also known as FDMTP. The campaign was observed from July 1, 2026, and targeted organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka.

ESET researcher Anh Ho said DarkVigil implants are typically deployed through popular Chinese applications. Other apps abused by the group include QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to. In the Sogou case, the attackers hijacked the app's branded vocabulary promotion mechanism to serve a malicious configuration. This led to malware being deployed through SGTool.exe, a legitimate Sogou component that works as a multi-purpose task dispatcher.

SlippyNunchucks has been active since at least September 15, 2023, and its attacks have deployed a modular .NET framework that includes DarkVigil and more than 20 plugins. DarkVigil has previously been linked to Mustang Panda, but ESET found no tactical overlaps and classed the group as a distinct intrusion set. Fortinet earlier detailed a supply chain compromise of the QuickFox VPN and network acceleration tool. ESET says the group moved to Sogou three days after QuickFox released a clean version of its program.