ESET observed attackers redirecting Sogou Input Method’s HTTP configuration requests to deliver DarkVigil on Windows. DNS or network-path manipulation is required; its location remains unknown. Upgrade to 16.10 and investigate existing infections: the update does not establish that implanted hosts are clean.
ESET describes a targeted surveillance operation, not a compromise of every Sogou installation or proof that Tencent’s servers were breached. The affected Windows component fetches brand-dictionary icon configuration over HTTP. In victim environments, DNS resolved the legitimate configuration host to attacker staging servers. A replacement configuration placed a signed Adobe helper and a DarkVigil DLL in locations used by existing component-loading workflows, enabling sideloading and persistence.
The attack requires control over DNS resolution or the traffic path; ESET could not determine whether manipulation occurred at routers, an ISP or elsewhere. It reports Sogou-mediated activity from July 1 in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman, while discussing a broader, older DarkVigil ecosystem separately. No victim total or aggregate loss is supplied. ESET tracks the China-aligned actor as SlippyNunchucks and says it found no overlap establishing Mustang Panda attribution. Those are researcher assessments, not a confirmed identity or proof that all previously mentioned applications shared this vector.
L4 reflects observed malicious delivery and execution through a widely used client. This entry covers CVE-2026-120422, not the separate CVE-2026-51990 mentioned as earlier research. Windows is the affected platform in the CNA record; no equivalent mobile flaw is established. Version 16.10 repairs the delivery weakness, but preexisting implants and their plugins require incident response. The original report’s October 29/30 remediation-day discrepancy is retained above; neither day changes the November 4 public disclosure date.
CVE-2026-120422CVSS 8.9SGTool.exe retrieves configuration over HTTP; attackers controlling DNS resolution or the network path can substitute instructions that place executable payloads in component-loading locations. ESET CNA scores CVSS 4.0 8.9; Windows versions before 16.10 are affected.
| Product | Safe from | Note |
|---|---|---|
| Sogou Input Method for Windows | 16.10 | Vendor release changes affected requests to HTTPS; ESET also reports certificate pinning |
Jul 1, 2026
ESET begins observing Sogou-mediated DarkVigil deployment
Retrospective telemetry from targeted environments, not the public disclosure date.
Sep 11, 2026
ESET reports the weakness to Tencent Security
Sep 21, 2026
Tencent acknowledges the issue
Oct 30, 2026
Official 16.10 changelog records security fixes
ESET’s disclosure timeline also dates remediation to October 30; one narrative passage instead says October 29. The version threshold is consistent, but the report’s day differs internally.
Nov 2, 2026
ESET assigns the CVE identifier
Nov 4, 2026
ESET publishes the operation and technical analysis
We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.