SlippyNunchucks Hijacks Sogou Input Method DNS to Deploy DarkVigil

# SlippyNunchucks Hijacks Sogou Input Method DNS to Deploy DarkVigil

https://gcdradar.vercel.app/incidents/slippynunchucks-hijacks-sogou-input-method-dns-to-deploy-dar · AIR-2026-1764 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed real-world targeting and backdoor deployment.
- Fix status: No fix needed
- First reported: 2026-11-04 (happened 2026-07-01)
- AI role: No AI role
- Products: Sogou Input Method

## Summary

A China-aligned threat actor dubbed SlippyNunchucks hijacked DNS requests in Windows versions of Sogou Input Method. The campaign abused insecure HTTP communications to deploy the DarkVigil backdoor for surveillance.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Affected and fixed versions

- Affected: Sogou Input Method Windows versions

## Latest updates

- 2026-11-04: China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor (https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html)

## Sources

- 2026-11-04 The Hacker News: China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor https://thehackernews.com/2026/11/china-aligned-hackers-hijack-sogou.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.