SlippyNunchucks hijacks Sogou Input Method DNS

China-aligned threat actor SlippyNunchucks exploited insecure HTTP communications in Windows versions of Sogou Input Method to hijack DNS requests and deploy the DarkVigil backdoor implant. The surveillance campaign targeted organizations starting July 2026. Sogou users should update to the latest version and consider disabling the input method if patching is unavailable.