A China-aligned group has hijacked the brand-promotion mechanism of Sogou Input Method to deliver the DarkVigil toolset to users in six countries, turning legitimate application traffic into a malware distribution channel.
ESET researcher Anh Ho detailed the activity in research published on November 4, naming the group SlippyNunchucks and tracing its activity to at least September 15, 2023. ESET assessed with high confidence that the group is associated with a nation-state surveillance effort aligned with Chinese government interests.
The campaign began on July 1, 2026, when users of Sogou Input Method, a popular Chinese-language keyboard app owned by Tencent, began receiving DarkVigil implants. The number and geographic spread of victims initially led ESET to suspect an exploit.
Hijacked Sogou Traffic Reached Six Countries
A Sogou component fetched a brand-promotion configuration from a Sogou server over unencrypted HTTP. Domain Name System (DNS) hijacking redirected those requests to attacker-controlled servers, which returned a malicious configuration.
That configuration made the app download the DarkVigil implant and place it where Sogou's own components would run it, giving the malware persistence without a separate mechanism.
ESET does not know where the DNS manipulation occurred. Possibilities include routers set up with malicious DNS settings, routers implanted to hijack DNS and interception at internet service provider (ISP) level.
Victims were in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman. They included a multinational gambling organization operating from Sri Lanka, the Philippines and Hong Kong, an internet café in Dubai and a university student in Denmark, though ESET gave no victim count.
Tencent Fixes Sogou as ESET Flags Remaining Gaps
DarkVigil, also known as FDMTP, is a modular .NET toolset with more than 20 plugins. Darktrace had linked FDMTP to Mustang Panda with moderate confidence, but ESET said its telemetry showed no overlap with that group and tracks SlippyNunchucks separately.
Before the Sogou campaign, the group's only publicly identified distribution method was a supply-chain compromise of QuickFox. ESET linked the gambling-sector targeting to China's gambling restrictions and to China-aligned groups' apparent support for law enforcement action against Chinese individuals tied to regional fraud.
ESET reported the issue to Tencent on September 11, and Tencent acknowledged it on September 21. Sogou Input Method version 16.10, released in late October, moved the affected requests to HTTPS and enabled certificate pinning.
ESET said the downloader component still does not validate downloaded file types or restrict where files are saved.
The fix closes the unencrypted request the attackers abused. Where their DNS hijacking took place remains unknown.