China-aligned group SlippyNunchucks hijacked the brand-promotion feature of Sogou Input Method to deliver the DarkVigil toolset to users in six countries, according to ESET researcher Anh Ho. ESET published the research on November 4.
ESET assessed with high confidence that the group is associated with a nation-state surveillance effort aligned with Chinese government interests. The firm said its activity dates to at least September 15, 2023.
The campaign began on July 1, 2026. Users of Sogou Input Method, a Chinese-language keyboard app owned by Tencent, began receiving DarkVigil implants.
A Sogou component fetched a brand-promotion configuration from a Sogou server over unencrypted HTTP. Domain Name System (DNS) hijacking redirected those requests to attacker-controlled servers, which returned a malicious configuration. That configuration caused the app to download the DarkVigil implant and place it where Sogou's own components would run it.
ESET does not know where the DNS manipulation occurred. The report lists possibilities, including routers with malicious DNS settings, routers implanted to hijack DNS, and interception at the internet service provider level.
Victims were in Hong Kong