CVE-2026-120422 Sogou Input Method abused to plant backdoor

Call: Patch now. Sogou Input Method (Sogou Pinyin) is one of the most widely used Chinese input method editors. ESET says a China-aligned group it calls SlippyNunchucks has been abusing the Windows version since July 1 to install a backdoor called DarkVigil. Tencent fixed the flaw, CVE-2026-120422, in version 16.10. ESET gives the release date as Oct 29 in one place and Oct 30 in its disclosure timeline. If anyone on your network types Chinese on Windows, find this app and update it.

What breaks: A Sogou component, SGTool.exe, fetches a configuration from config.pinyin.sogou[.]com over plain HTTP. ESET counted 20 endpoints on that host that the app calls without TLS. The attackers controlled DNS for the victims, so the request went to their server, which answered with a malicious configuration. That configuration told Sogou to download a renamed, legitimately signed Adobe binary and a DarkVigil DLL, and to drop them where Sogou’s own component manager would run them. No separate persistence needed. Sogou’s own update and component workflow did the work.

ESET doesn’t know where the DNS hijacking happens. Its suspects are compromised routers or interception at the ISP.

Who’s hit: Windows users of Sogou Input Method before 16.10. ESET saw victims in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka, and the group has also hit individuals in Germany, Russia, the UK and Austria. This is targeted espionage, not a mass campaign. But the hole is in the app, and anyone whose DNS can be tampered with is exposed.

What to do:

Update to 16.10 or later. It moves the affected requests to HTTPS with certificate validation, and ESET says certificate pinning too.
Find it first. It’s a consumer IME. It may not be in your software inventory, and it may be on personal or BYOD machines that touch your network.
Check for leftovers on machines that ran an older version: unexpected SogouComMgr.exe or libcef.dll files under Sogou’s \Components\ folder. ESET publishes hashes and network indicators in its write-up.
Look at your DNS. If routers or resolvers handed out answers they shouldn’t, fix that too. ESET also says other weaknesses remain after 16.10: SGTool.exe should check that downloads are the image files it expects and keep them inside designated folders.

Sources: ESET WeLiveSecurity (opens in a new tab), ESET press release (opens in a new tab), The Hacker News (opens in a new tab).

CVE-2026-120422 Sogou Input Method abused to plant backdoor

Sources

More from October 2026 patch cycle