{"id":"CVE-2026-120422","kind":"vulnerability","aliases":["CVE-2026-120422"],"related":[],"title":"Sogou Input Method for Windows: plain-HTTP config fetch was hijacked via DNS to install DarkVigil malware; fixed in 16.10","description":"Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.","summary":"Sogou Input Method's SGTool.exe fetches its configuration over plain HTTP, so an attacker on the network path can swap in a malicious response. That response can make the tool download attacker-chosen files into locations the app loads, which can lead to arbitrary code execution on the Windows machine.","severity":"high","cvss":8.9,"epss":null,"exploited":true,"exploited_at":null,"products":[{"name":"Sogou Input Method (Windows)","fixed":["16.10"],"affected":"< 16.10 (earliest affected version not stated)","ecosystem":"vendor"}],"ecosystems":[],"tags":["darkvigil","dns-hijacking","http","other","sgtool","sogou-input-method","windows"],"not_affected_if":["no-network-attacker","not-installed","sogou-not-installed","version-16.10-or-later"],"how_to_check":"- Open Sogou Input Method's About dialog or Windows Apps list and confirm the version is 16.10 or later; older means update.\n- Look for SGTool.exe under C:\\Program Files (x86)\\SogouInput\\<version>\\.\n- Check DNS/proxy logs for config.pinyin.sogou.com resolving to 47.239.250.102 or 47.237.122.175, or any contact with sogou-cdn.com (ESET IOCs).","fix":"Update Sogou Input Method for Windows to version 16.10 or later (released 2026-10-29/30 per ESET), which moves the affected requests to HTTPS.","status":"open","published_at":"2026-11-04T10:17:26+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","triaged_at":"2026-11-04T10:27:06+00:00","updated_at":"2026-11-04T10:29:18+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-04T10:27:06Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Sogou Input Method for Windows: unencrypted config fetch lets attackers run code","impact":"high","summary":"Sogou Input Method's SGTool.exe fetches its configuration over plain HTTP, so an attacker on the network path can swap in a malicious response. That response can make the tool download attacker-chosen files into locations the app loads, which can lead to arbitrary code execution on the Windows machine.","audience":"everyone","category":"other","nicknames":[],"who_cares":["windows","sogou-input-method","sgtool"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs arbitrary code on the Windows machine via swapped downloads","analyst_note":"Confirm affected Sogou version range and whether a vendor patch or HTTPS switch exists; the NVD entry is the only source.","how_to_check":"- Check the installed Sogou Input Method version in its Windows program list entry or About dialog\n- Look for SGTool.exe on the machine and confirm whether the Sogou Input Method is installed at all\n- unknown for the exact vulnerable version range","plain_action":"If you use Sogou Input Method on Windows, check for a vendor update and avoid using it on untrusted networks until one is installed.","needs_analyst":true,"not_affected_if":["not-installed","no-network-attacker"],"who_is_affected":"Windows computers with Sogou Input Method installed, where SGTool.exe runs and fetches its configuration over HTTP. The risk needs an attacker who can manipulate traffic between the machine and the server, such as on a shared or hostile network. Machines without Sogou Input Method installed are not affected.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000737,"input_tokens":4223,"output_tokens":630,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm affected Sogou version range and whether a vendor patch or HTTPS switch exists; the NVD entry is the only source.","search":"'-120422':24A,27A '-2026':23A,26A '16.10':21A 'allow':123C 'app':84B 'applic':115C,162C,182C 'arbitrari':90B,155C,168C 'attack':59B,78B,125C,140C,151C 'attacker-chosen':77B 'attacker-control':150C 'capabl':126C 'chosen':79B 'code':91B,169C 'compon':113C,163C 'config':9A 'configur':53B,107C,117C,138C 'connect':122C 'contain':102C 'control':152C 'cve':22A,25A 'darkvigil':17A,28A,34B 'data':118C 'dns':14A,36B 'dns-hijack':35B 'download':76B,149C,173C 'execut':92B,170C,177C 'exploit':142C 'fetch':10A,51B 'file':80B,153C,174C 'fix':19A 'hijack':12A,37B 'http':8A,38B,56B,121C 'includ':157C 'input':2A,31A,43B,47B,98C 'instal':16A 'instruct':146C 'lead':88B 'legitim':133C,161C 'load':85B,179C 'locat':82B,156C 'machin':96B 'make':73B 'malici':68B,137C 'malwar':18A 'manipul':128C 'mechan':109C 'method':3A,32A,44B,48B,99C 'network':62B,129C 'path':63B,158C 'plain':7A,55B 'plain-http':6A 'replac':132C 'respons':69B,71B,135C 'result':166C 'retriev':108C,116C 'server':134C 'sgtool':40B 'sgtool.exe':50B,112C,147C 'slippynunchucks':29A 'sogou':1A,30A,42B,46B,97C 'sogou-input-method':41B 'subsequ':176C 'swap':65B 'tool':75B 'traffic':130C 'unencrypt':120C 'use':159C 'via':13A 'vulner':104C,144C 'window':5A,45B,95B,101C 'windows':33A","nicknames":["DarkVigil","SlippyNunchucks"],"mitigations":[],"who_affected":"Windows PCs running Sogou Input Method (Sogou Pinyin) older than 16.10, where SGTool.exe fetches configuration over plain HTTP from config.pinyin.sogou.com. An attacker who controls DNS or the network path (for example a compromised router or ISP-level interception) can serve a malicious configuration that makes SGTool.exe place and run payloads. ESET saw this exploited from July 2026 against organizations and Chinese-speaking users in Hong Kong, Thailand, Japan, Vietnam, Oman and Sri Lanka. Machines without Sogou, or on 16.10+, can skip it.","tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update Sogou Input Method on your Windows PC to the latest version (16.10 or newer) using its built-in update or Sogou's website.","pkeys":["darkvigil","inputmethodwindows","slippynunchucks","sogouinputmethodwindows"],"ptokens":["input","method","sogou","windows"],"labels":["darkvigil","dnshijacking","high","http","other","sgtool","sogouinputmethod","windows"],"campaign_type":null,"first_public_at":"2026-11-04T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:X/R:U/V:D/RE:M/U:X","cvss_by":"security@eset.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120422","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120422","severity":null,"published_at":"2026-11-04T10:17:26+00:00","modified_at":"2026-11-04T10:17:26+00:00","first_seen_at":"2026-11-04T10:26:34+00:00","fetched_at":"2026-11-04T10:26:34+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-120422:1657","url":null,"severity":null,"published_at":"2026-11-04T10:28:45+00:00","modified_at":"2026-11-04T10:28:45+00:00","first_seen_at":"2026-11-04T10:28:45+00:00","fetched_at":"2026-11-04T10:28:45+00:00","note":"ESET Research (Anh Ho) blog + press release: exploited in the wild since 2026-07-01 by SlippyNunchucks via DNS hijack to deliver DarkVigil; Tencent fixed in 16.10 (HTTPS), disclosed 2026-11-04. Not marked verified: fix is relayed by ESET, Tencent's own page not read. Earliest affected version unknown. How the DNS was hijacked is unknown. Tier might merit A (exploited)."}],"documents":[{"id":65997,"url":"https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/","title":"SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware (ESET Research)","kind":"blog","source":"analyst","publisher":null,"text":"ESET: China-aligned SlippyNunchucks (active since at least 2023-09-15) hijacked DNS for config.pinyin.sogou[.]com from 2026-07-01; Sogou Input Method for Windows requested getBrandScd.php over plain HTTP, malicious config made SGTool.exe download a disguised Adobe binary (biz_helper.exe) and DarkVigil (FDMTP) .NET backdoor DLL (libcef.dll) into Components folder. Victims Chinese speakers in Hong Kong, Thailand, Japan, Vietnam, Oman, Sri Lanka. Tencent fixed in 16.10 (end Oct 2026) with HTTPS and cert pinning. IoCs: sogou-cdn[.]com, dev.soft-png-cdn[.]com, blog.wangmengfun[.]top, update.mssproxy[.]net, img.fusfun[.]top; 47.237.122[.]175, 47.239.250[.]102, 47.236.254[.]159, 47.86.15[.]162; SHA-1 8A60A8E90E1F5F08F28FE5A6DD57BD686C20DC23 (libcef.dll), 3E16BA611782AF6E45576D390488D28FD676BADE, 79188C8DE2378B437D39E867475C5B4714A0D7C9 (biz_helper.exe); HKCU\\Software\\Microsoft\\IME\\<HWID>\\pluginHash. Full IoCs github.com/eset/malware-ioc/slippynunchucks.","published_at":"2026-11-04T00:00:00+00:00","relation":"advisory","confidence":null,"note":null},{"id":66161,"url":"https://www.eset.com/us/about/newsroom/research/slippynunchucks-sogou-input-method-dns-hijacking-eset-research/","title":"ESET press release: SlippyNunchucks hijacks language app","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":65980,"url":"https://x.com/ESETresearch/status/2117920058735219195","title":"@ESETresearch: DarkVigil implements a unique C&amp;C architecture using DMTP, a network protoco","kind":"post","source":"x","publisher":null,"text":"DarkVigil implements a unique C&amp;C architecture using DMTP, a network protocol. This architecture is analyzed in detail in our blogpost. 6/7\n\nlikes 0 reposts 0","published_at":"2026-11-04T10:01:05+00:00","relation":"discussion","confidence":null,"note":"@ESETresearch"},{"id":65985,"url":"https://x.com/ESETresearch/status/2117920053370745063","title":"@ESETresearch: #ESETresearch has uncovered a surveillance method used to target Chinese speaker","kind":"post","source":"x","publisher":null,"text":"#ESETresearch has uncovered a surveillance method used to target Chinese speakers abroad. The threat actor, 🇨🇳 China-aligned SlippyNunchucks, hijacked DNS resolution for Sogou Input Method traffic to facilitate malware delivery. https://t.co/MwRraozHUY 1/7 https://t.co/nQObdPj0ro\n\nlikes 6 reposts 2","published_at":"2026-11-04T10:01:04+00:00","relation":"discussion","confidence":null,"note":"@ESETresearch"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}