ESET tied a DNS-hijacking campaign to a Chinese input method's plaintext vocabulary fetches, delivering the DarkVigil backdoor since July.