Sogou Input Method is the kind of app most people install once and forget. That is exactly why the campaign ESET describes is so troubling. A China-aligned group, which ESET calls SlippyNunchucks, used the app's brand-promotion mechanism to push the DarkVigil toolset to users in six countries, including Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman. A keyboard that people trust to see everything they type became a delivery channel for surveillance malware.
The technical failure is plain. According to ESET researcher Anh Ho, a Sogou component fetched its brand-promotion configuration over unencrypted HTTP. Attackers used DNS hijacking to redirect those requests to their own servers, which returned a malicious configuration. The app then downloaded the implant and placed it where Sogou's own components would run it. Nothing about that chain should have been possible in a widely used commercial product. Fetching configuration over plain HTTP in 2026 is an avoidable design choice, and it made a remote, low-cost attack practical.
Tencent deserves some credit for the response. ESET reported the issue on September 11, Tencent acknowledged it on September 21, and version 16.10, released in late October, moved the affected requests to HTTPS and enabled certificate pinning. That closes the specific door attackers used. But ESET also said the downloader component still does not validate downloaded file types or restrict where files are saved. A fix that removes one entry point while leaving the downloader's broader weaknesses in place is a partial answer, and users should not treat it as a clean bill of health.
The unanswered question matters too. ESET does not know where the DNS manipulation occurred. It could have been a router with malicious DNS settings, a router that had been implanted, or interception at the internet service provider level. Each possibility points to a different responsible party and a different remedy. Users cannot protect themselves against an attack they cannot locate, and regulators and router vendors should press for an investigation that can narrow it down.
Keyboard and input software sits at the center of people's digital lives, so vendors should be held to a higher standard than they currently meet. Every update that touches network behavior should be reviewed for encryption and integrity. Software should verify what it downloads and where it writes it. Users in affected regions should update to version 16.10 now and check whether any unexpected components were placed on their machines.