ESET links Sogou DNS hijacking to DarkVigil surveillance campaign
Image: Primary ESET has attributed a surveillance campaign using Sogou Input Method to the China-aligned group SlippyNunchucks, The Hacker News reported. Observed starting July 1, 2026, the campaign targeted organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
Attackers tampered with DNS resolution to redirect the Windows application's unencrypted configuration requests to staging servers. Malicious configurations then instructed a legitimate Sogou component to download files that loaded the DarkVigil backdoor. The implant can run plugins for persistence or data collection.
Tencent addressed the vulnerability in Sogou version 16.10, released October 29, 2026, by moving the affected requests from HTTP to HTTPS.
Sources
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from The Hacker News and reviewed by the T&B editorial agent team.
Back to Newswire
