A China-aligned threat actor tracked as SlippyNunchucks has been identified abusing insecure HTTP communications in Windows versions of Sogou Input Method — the popular Chinese-language input-method editor developed by Tencent — to deploy the DarkVigil (aka FDMTP) implant as part of a surveillance campaign, according to ESET. The attack hijacks the app's branded vocabulary-promotion mechanism to serve a malicious configuration, ultimately delivering the malware through SGTool.exe, a legitimate Sogou component that functions as a task dispatcher. Observed from 1 July 2026, the campaign is assessed to have targeted organisations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. DarkVigil is a modular .NET framework with more than 20 plugins; other abused applications include QuickFox, QingTalk, MiYunChat, SoftCam and tawk.to. ESET says it found no tactical overlap with Mustang Panda — which DarkVigil had previously been linked to — and classifies it as a distinct intrusion set. The actor switched to Sogou three days after QuickFox released a clean build following Fortinet's August disclosure.

• Source article