The Sogou Input Method, a keyboard app owned by Tencent and favored by Chinese speakers, has been used as a landing point for an implant ESET calls DarkVigil. Whoever runs it is tracked as SlippyNunchucks, and the vendor’s records show infections from July 1, 2026 onward across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
Brand vocabulary promotion turned out to be the weak link. To show sponsored names, the keyboard pulls a configuration over plain HTTP and renders whatever comes back inside its own window, so a reply arriving from a hostile resolver arrives pre-trusted. Commands placed in that reply made the software fetch and start the payload.
Delivery ran through SGTool.exe, a signed component that handles routine tasks for the keyboard. Anh Ho, who along with ESET’s threat research team published the findings, notes that DarkVigil usually reaches targets through a handful of popular Chinese apps, which widens the actor’s reach into diaspora communities far outside mainland China.
A tampered QuickFox build was documented by Fortinet earlier in the run, and ESET adds QingTalk, MiYunChat, SoftCam, and tawk.to to the list. Once QuickFox shipped a clean version, the actor switched lures within days rather than pausing.
DarkVigil itself is a .NET framework assembled from more than 20 modules. Analysts had earlier linked it to Mustang Panda, but ESET reports no shared tactics, infrastructure, or victim patterns and tracks the campaign as its own operation.
Every unencrypted update check an app performs is a potential way in. Administrators running Chinese-language utilities should log DNS replies for those hosts and treat a successful plaintext lookup as a hostile answer until proven otherwise.
