Hackers Turn Popular Chinese Keyboard Software Into a Backdoor for Cyberespionage Attacks

The SlippyNunchucks threat actor exploited a DNS hijacking vulnerability in Sogou Input Method software to redirect legitimate update requests to attacker-controlled servers, silently installing the DarkVigil backdoor without requiring any user interaction or traditional exploit. This attack abuses the inherent trust users and systems place in software update mechanisms, turning a routine process into a stealthy compromise vector. The modular nature of the DarkVigil/FDMTP toolset — with over 20 plugins — means attackers can expand their foothold in highly flexible ways once installed. This matters because widely deployed input software represents a broad, often overlooked attack surface, particularly in enterprise environments where such tools are rarely scrutinized for security risks.