A China-aligned group called SlippyNunchucks hijacked DNS requests from Sogou Input Method on Windows to deploy the DarkVigil backdoor. Here's what you need to know and how to stay safe.
You know that little keyboard app you use to type Chinese characters? The one that feels harmless? Well, it just became the center of a pretty sneaky cyberattack. A group called SlippyNunchucks — believed to be working for China — found a way to hijack DNS requests from the Windows version of Sogou Input Method. And they didn't do it to show off. They did it to drop a backdoor called DarkVigil.
This isn't some old vulnerability. The campaign was first spotted on July 1, 2026. And it's still being analyzed. The attackers didn't break encryption or crack passwords. Instead, they took advantage of something much simpler: insecure HTTP communications. That's right — plain old HTTP, the unencrypted web protocol we've been told to abandon for years.
### How the Attack Works
So here's the deal. Sogou Input Method, like many apps, sometimes sends DNS queries over HTTP. That means when your computer asks "where is this server?", the answer comes back in plain text. Anyone listening on the network can see it — and more importantly, change it.
SlippyNunchucks figured that out. They intercepted those DNS requests and redirected them to servers they control. From there, they pushed the DarkVigil implant onto victims' machines. And once it's in, it can do all the nasty things backdoors do: steal data, watch what you type, move laterally through your network.
It's a classic man-in-the-middle attack, but with a twist. Instead of targeting a browser or a system update, they went after a third-party input tool. That's clever because input methods often have deep system access and are rarely scrutinized by security teams.
### Why This Matters for You
If you're in the US and you use Sogou Input Method on Windows — even just for typing Chinese — you need to pay attention. This isn't a theoretical risk. The campaign targeted organizations, and it's assessed to have been active for a while. The attackers weren't just casting a wide net; they were going after specific targets.
And here's the thing: most people don't think about their input method as a security risk. It's just there, helping you type. But that's exactly why it's a perfect entry point. No one suspects the keyboard app.
> "The most dangerous malware is the kind you never see coming. And right now, Sogou Input Method is a blind spot for a lot of people."
### What Can You Do?
First, check if you're using Sogou Input Method on Windows. If you are, consider switching to an alternative until this is patched. Second, make sure your DNS queries are encrypted. Use DNS over HTTPS (DoH) or DNS over TLS (DoT) wherever possible. That would have stopped this attack cold.
- **Update everything**: Keep your OS and all apps patched. This attack relied on an insecure protocol, but patches often close these holes.
- **Monitor your network**: Look for unusual DNS traffic. If you see queries going to strange IP addresses, that's a red flag.
- **Use a VPN**: A good VPN encrypts all your traffic, including DNS requests, making interception much harder.
- **Think before you install**: Third-party input methods, browser extensions, and utilities can be vectors. Only install what you trust.
### The Bigger Picture
This campaign is a reminder that attackers are creative. They don't always go for the front door. Sometimes they slip in through the side window — the one you forgot to lock. Sogou Input Method is used by millions of people, and most of them never considered it a security risk. Now we know better.
So if you're a security professional, add input methods to your threat model. If you're a regular user, be cautious about what you install. And if you're using Sogou on Windows right now, maybe switch to something else until the dust settles. Your data is worth it.
