ESET Research published an analysis on 4 November, by Anh Ho, of a DNS hijacking operation against the Windows version of Sogou Input Method, one of the most widely installed Chinese input method editors. The weakness now carries CVE-2026-120422, assigned by ESET's own CNA on 2 November.

The mechanism is almost disappointingly simple, and that is the point.

The brand promotion mechanism

Since April 2016 Sogou has run a Startup Brand Support Program. Companies submit a brand name and, once approved, it appears in the input method's candidate list with a green sprout icon beside it. It is a marketing feature inside a keyboard.

Delivering those icons needs a configuration file. A Sogou component called SGTool.exe, run with an update argument, fetches that configuration from a Sogou host over plain HTTP. ESET counts 20 endpoints on the same host reached the same way.

Whoever controlled DNS resolution for that host pointed it at their own staging servers. Those servers returned a configuration encrypted the way the real one is, with the md5 fields rewritten to match the attacker's own payloads, so the integrity check passed on the attacker's files.

The configuration told the component to fetch two things: a legitimately signed Adobe Licensing WF Helper, renamed, and a library called libcef.dll, which is the DarkVigil implant. The signed binary is placed where Sogou will run it, and it side-loads the implant.

DarkVigil is a modular .NET toolset with more than 20 known plugins, managed through a branded web panel, with the plugins stored as compressed binaries in a registry key.

This is not a vulnerability in the usual sense

There is no memory corruption here, no injection, no logic flaw in a parser. The product asked an unauthenticated question over an unauthenticated channel and believed the answer. The integrity check that did exist was computed over fields the answer itself supplied.

Which is why the fix is small and complete. Tencent moved the requests to HTTPS with certificate validation and added certificate pinning, in version 16.10.

The disclosure timeline is a good one

ESET reported the weakness to the Tencent Security Response Center on 11 September 2026. Tencent acknowledged it on 21 September. Version 16.10 shipped at the end of October. The CVE was assigned on 2 November and the research published on 4 November.

That is a vendor responding properly, and it is worth saying plainly, because the same company's product is the subject of the complaint.

Who, and where

ESET tracks the operator as SlippyNunchucks, active since at least 15 September 2023, and assesses with high confidence that it is associated with a nation-state surveillance effort aligned with Chinese government interests. ESET finds no overlap with Mustang Panda, which some public reporting links to DarkVigil, and treats SlippyNunchucks as a distinct group.

Victims of this campaign were in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman. The group's wider targeting covers South and East Asia, with occasional victims in Europe.

The part ESET cannot answer

Where is the DNS being manipulated?

ESET lists the possibilities and declines to choose: routers compromised and pointed at malicious DNS servers, routers implanted to hijack specific lookups, or interception at an internet service provider. It says the vector remains unresolved.

That matters more than it sounds. Those three have very different implications for how many people were exposed and for who is doing it, and an operation able to steer one hostname's resolution across six countries is not the same thing in each case.

The catalogue, again

We checked the CISA catalogue of known exploited vulnerabilities as released on 4 November 2026, 1,768 entries. CVE-2026-120422 is not in it. Neither is CVE-2026-51990, the separate Sogou remote code execution that Gen Threat Labs found inside an intrusion earlier this year. Tencent and Sogou have never had an entry in it at all.

That is the same observation we made about the Apple and Qualcomm flaws APT29 was chaining, approached from the other end. The catalogue is strong evidence of what United States federal networks see. A Chinese-language keyboard with victims in Oman and Sri Lanka is not on those networks, and the catalogue is not the place to learn about it.

What to do

  • Update Sogou Input Method to 16.10 or later on every Windows machine that has it, including personal machines used for work.
  • Look for the Sogou component manager replaced by an Adobe-signed binary, and for a libcef.dll sitting beside it that should not be there.
  • Treat any software that fetches configuration over plain HTTP as a supply chain, whatever the configuration is for. This one was for icons.
  • If you run networks in the affected region, check what your resolvers return for vendor update hosts, not only for the obvious ones.

What is not established

  • Where the DNS is being manipulated. ESET lists three possibilities and confirms none.
  • How many people were affected. No count exists.
  • Which Sogou versions before 16.10 are vulnerable. ESET gives no range.
  • Whether newer DarkVigil builds behave as described. The command and control analysis rests on 2025 samples.
  • Attribution is ESET's, at high confidence, to a nation-state aligned effort. No individual or agency is named.