SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
At a glance
Low rather than Medium: UK relevance is 40 of 100, little UK-specific signal so far.
Briefing
There is no written leader briefing for this story yet. The summary below says what is known so far.
Next steps
Monitor- For awareness — no fixed action deadline for this reporting
No technical write-up beyond the summary below yet.
Next steps
Monitor- No immediate technical action — track if your estate depends on the products or vendors discussed
Summary
- ESET Research analyses a DNS hijacking operation abusing insecure HTTP communications in Windows versions of At ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025. Across the campaigns we have analysed, one behaviour has remained consistent: DarkVigil implants are typically deployed through popular Chinese applications.
Read the original reportESET WeLiveSecurity(opens in a new tab)
Part of Adobe Commerce and Magento Improper Neutralization of Special Elements Used in a Template Engine Vulnerability
Pulse
Last change 3d ago · Recheck overdue since 6 Nov 2026, 06:17 UK time
- Story5 Nov 2026, 06:17 UK time · 3d ago
Linked reporting from ESET WeLiveSecurity (research).
Read source (ESET WeLiveSecurity)
1 entry so far. The timeline chart appears once this story has more history.
Sources
- ESET WeLiveSecurityResearcher
SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware
- ProbableSummary fact75% confidence
ESET Research analyses a DNS hijacking operation abusing insecure HTTP communications in Windows versions of At ESET, we have been tracking the DarkVigil toolset (also known as FDMTP) and its operator, the SlippyNunchucks threat actor, since 2025. Across the campaigns we have analysed, one behaviour has remained consistent: DarkVigil implants are typically deployed through popular Chinese applications.