ESET detailed a campaign by SlippyNunchucks targeting organizations and users by exploiting insecure HTTP update mechanisms in Sogou Input Method to deploy the DarkVigil implant.
Tencent addressed the flaw as CVE-2026-120422.
Who are the perpetrators and what did they target?
The group behind the attack is called SlippyNunchucks and has been active since at least September 2023, according to observations by security researchers from ESET that began on July 1, 2026. The attacks targeted, among others, an organization that operates online gaming platforms in Sri Lanka, Hong Kong, and the Philippines.
In the past, the same perpetrators have exploited other well-known applications, such as QuickFox, QingTalk, MiYunChat, SoftCam, and tawk.to. In fact, security companies have previously detected similar attempts to tamper with the QuickFox application to install the same malicious program.
How the attack on the typing app worked
The recent operation targeted Sogou Input Method, a popular Chinese-language keyboard developed by Tencent. The attackers exploited the fact that the app used insecure connections for its communication and interfered with the app's push mechanism.
↳
READ ALSO
HACKS.GR / RELATED
Cyber Attacks & Data Breaches
How a business digital assistant sent mass emails from a personal account
↗
This intervention forced the program to download a modified setting and then two additional malicious files from computers controlled by the attackers. The monitoring software that was eventually installed on the computers is called DarkVigil, also known as FDMTP.
The company's reaction and correction
Tencent addressed the issue by releasing version 16.10 of the app on October 29, 2026. This update fixes the security flaw by making all relevant app communications secure.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)