China-Aligned Hackers Hijack Sogou Input Method DNS Requests to Deploy DarkVigil Backdoor

A China-aligned threat actor known as SlippyNunchucks has been attributed to a DNS hijacking operation abusing insecure HTTP communications in the Windows version of Sogou Input Method, The Hacker News reports. The surveillance campaign, observed since July 1, 2026, deploys an implant called DarkVigil.