SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware

As cited

Copy frozen at 2026-11-05 08:59 UTC (site build).

threat intel

SlippyNunchucks hijacks Sogou Input Method’s brand promotion mechanism to distribute malware

ESET Research identified a DNS hijacking campaign called SlippyNunchucks that exploits unencrypted HTTP communications in Sogou Input Method for Windows to distribute malware through the application's brand promotion mechanism. The attackers intercept network traffic to redirect promotional content and inject malicious payloads into the legitimate update channel.

Why it matters: Organizations and users with Sogou Input Method installed on Windows systems face malware infection risk through a supply chain attack that compromises a trusted application's update mechanism.

Source published

2026-11-04 09:55 UTC

First seen by Cybersecurity Tracker

2026-11-05 08:00 UTC