# SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware

DNS hijack of Sogou Input Method's plaintext HTTP brand-icon config endpoint let attackers serve a malicious config that planted DarkVigil malware via component workflows.

- Payout: Real-world hack
- Severity: high
- Program: Sogou Input Method
- Analysis by: ESET Research
- Disclosed: 2026-11-04
- CVE: CVE-2026-120422
- Write-up quality: 8/10
- Original: https://www.welivesecurity.com/en/eset-research/slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-malware/
- Library page: https://bugbountylibrary.com/r/blog%3Awelivesecurity-com-en-eset-research-slippynunchucks-hijacks-sogou-input-methods-brand-promotion-mechanism-to-distribute-
- Tags: area:os domain:desktop impact:data-leak impact:rce kind:incident platform:threat-intel sev:high tech:windows technique:recon technique:source-review vuln:misconfiguration

**Target:** SGTool.exe brandScd config endpoint (config.pinyin.sogou.com/api/brandScd/getBrandScd.php)
**Root cause:** SGTool.exe fetches the brand cell-dictionary icon config over unencrypted HTTP, so anyone controlling DNS resolution can substitute a malicious config. The config's md5 fields and icon destination paths are attacker-controllable, letting payloads be written into component directories.
**Steps:**
1. Observe SGTool.exe launched with `--appid=scdreg -update` sends HTTP GET to `config.pinyin.sogou[.]com/api/brandScd/getBrandScd.php`
2. Hijack DNS so config.pinyin.sogou[.]com resolves to staging server (47.239.250[.]102 / 47.237.122[.]175) serving sogou-cdn[.]com
3. Serve AES-256-CBC config (key/IV from SGTool.exe .rdata) with modified md5 fields and icon paths pointing to `\Components\SogouComMgr.exe` and `\Components\libcef.dll`
4. SGTool.exe downloads signed Adobe biz_helper.exe renamed SogouComMgr.exe and DarkVigil libcef.dll to those paths
5. SGTool.exe launches SogouComMgr.exe (now Adobe binary) which side-loads libcef.dll, executing DarkVigil
6. Alternative: place payloads under `\Components\biz_center\<version>\` executed via `-invoke BizCenterComBundle BizCenterCom`
**How found:** After QuickFox supply chain was cleaned, ESET still saw DarkVigil launched by SGTool.exe. Volume and geographic spread suggested an exploit, but tracing SGTool.exe's network calls revealed the plaintext HTTP brandScd config request and 20 other HTTP endpoints on the official host, pointing to DNS hijacking rather than code execution.
**Exploitation:** Attacker controls DNS for config.pinyin.sogou.com (compromised router, malicious DNS implant, or ISP interception). Malicious config overwrites SogouComMgr.exe with signed Adobe binary that side-loads DarkVigil libcef.dll; persistence borrowed from Sogou's own component-install workflow. Implant then beacons to C&C over DMTP, receives plugins stored in HKCU\Software\Microsoft\IME\<HWID>\pluginHash, and exfiltrates data.
**Escalation:** Two execution paths (SogouComMgr.exe replacement and biz_center versioned directory); only one can be achieved at a given time.
**Insight:** Enumerate every plaintext HTTP endpoint a signed desktop app calls to its own backend; config-fetch endpoints that carry download URLs and destination paths are prime targets for DNS-level hijack, especially when integrity fields (md5) are attacker-supplied rather than signed.