Tencent Sogou Input Method · Exploitation reported

China-aligned hackers exploited Sogou Input flaw to deliver DarkVigil

Nov 04, 2026 · 1 min read

China-aligned hackers exploited a flaw in Tencent's Sogou Input Method to deploy the DarkVigil surveillance backdoor, The Hackers News reports. The attack hijacked DNS requests and abused unencrypted HTTP traffic to deliver the malware. The source does not mention an available fix.

By HIFY Radar newsroom Updated 11/04/2026 08:28 AM Get this every day →← Back to the feed 1 source

HighVulnerabilityExploitation reportedFix unconfirmed

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

China-aligned hackers exploited a flaw in Tencent's Sogou keyboard to install the DarkVigil surveillance backdoor, The Hackers News reports. The attack intercepted DNS requests and unencrypted HTTP traffic to deliver the malware. Users of the Sogou Input Method are the target.

Why it matters

DarkVigil is a surveillance backdoor: it enables spying on compromised devices. The attack relies on interceptable traffic, so networks where DNS and HTTP can be manipulated are attack ground. The source mentions no fix, so exposure may remain open.

What to do

Map where the Sogou Input Method is used in the company. Force encrypted traffic (HTTPS and protected DNS) and restrict its use on untrusted networks. Track Tencent communications about a fix and consider replacing the keyboard until a clear patch exists.

For the technical team

Affected: Tencent Sogou Input Method (método de entrada) · Tencent Sogou Input Method; versions not specified in the source.
Exploitation: Exploitation reported by The Hackers News, attributed to China-aligned hackers.
Fix: The source does not mention a fix or mitigation.
Vector: Component: Tencent Sogou Input Method. Flaw exploited via hijacked DNS requests and unencrypted HTTP traffic to deliver the malware. Exploitation condition: victim traffic must be interceptable; internal flaw details not specified in the source.
More details: Payload delivered: DarkVigil surveillance backdoor. Chain: DNS hijacking and unencrypted HTTP as delivery vector. Technical details in the article linked by the source.