---
id: "CVE-2026-120422"
kind: "vulnerability"
aliases: ["CVE-2026-120422"]
title: "Sogou Input Method for Windows: plain-HTTP config fetch was hijacked via DNS to install DarkVigil malware; fixed in 16.10"
severity: "high"
cvss: 8.9
epss: null
exploited: true
status: "open"
category: "other"
products: [{"name": "Sogou Input Method (Windows)", "fixed": ["16.10"], "affected": "< 16.10 (earliest affected version not stated)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["darkvigil", "dns-hijacking", "http", "other", "sgtool", "sogou-input-method", "windows"]
not_affected_if: ["no-network-attacker", "not-installed", "sogou-not-installed", "version-16.10-or-later"]
published_at: "2026-11-04T10:17:26+00:00"
first_seen_at: "2026-11-04T10:26:34+00:00"
updated_at: "2026-11-04T10:29:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-120422", "first_seen_at": "2026-11-04T10:26:34+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-04T10:28:45+00:00"}]
---

# Sogou Input Method for Windows: plain-HTTP config fetch was hijacked via DNS to install DarkVigil malware; fixed in 16.10

Sogou Input Method's SGTool.exe fetches its configuration over plain HTTP, so an attacker on the network path can swap in a malicious response. That response can make the tool download attacker-chosen files into locations the app loads, which can lead to arbitrary code execution on the Windows machine.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Sogou Input Method (Windows) affected < 16.10 (earliest affected version not stated) fixed 16.10

## How to check

- Open Sogou Input Method's About dialog or Windows Apps list and confirm the version is 16.10 or later; older means update.
- Look for SGTool.exe under C:\Program Files (x86)\SogouInput\<version>\.
- Check DNS/proxy logs for config.pinyin.sogou.com resolving to 47.239.250.102 or 47.237.122.175, or any contact with sogou-cdn.com (ESET IOCs).

## Fix

Update Sogou Input Method for Windows to version 16.10 or later (released 2026-10-29/30 per ESET), which moves the affected requests to HTTPS.

## Timeline

- 2026-11-04T10:26:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-120422
- 2026-11-04T10:28:45+00:00 analyst — ESET Research (Anh Ho) blog + press release: exploited in the wild since 2026-07-01 by SlippyNunchucks via DNS hijack to deliver DarkVigil; Tencent fixed in 16.10 (HTTPS), disclosed 2026-11-04. Not marked verified: fix is relayed by ESET, Tencent's own page not read. Earliest affected version unknown. How the DNS was hijacked is unknown. Tier might merit A (exploited).

## Documents

- [advisory] SlippyNunchucks hijacks Sogou Input Method's brand promotion mechanism to distribute malware (ESET Research) https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/
- [describes] ESET press release: SlippyNunchucks hijacks language app https://www.eset.com/us/about/newsroom/research/slippynunchucks-sogou-input-method-dns-hijacking-eset-research/
- [discussion] @ESETresearch: DarkVigil implements a unique C&amp;C architecture using DMTP, a network protoco https://x.com/ESETresearch/status/2117920058735219195
- [discussion] @ESETresearch: #ESETresearch has uncovered a surveillance method used to target Chinese speaker https://x.com/ESETresearch/status/2117920053370745063

## From the sources

Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_