A China-backed threat actor, dubbed SlippyNunchucks, has been linked to a DNS hijacking operation that exploits insecure HTTP communications within Windows versions of Sogou Input Method This article explores malware sgtool exe. . This campaign, initiated on July 1, 2026, targets organizations and Chinese-speaking individuals in Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka.
The attack hijacks the app's branded vocabulary promotion mechanism to serve a malicious configuration, ultimately deploying malware via SGTool.exe, a legitimate Sogou Input Method component that functions as a multi-purpose task dispatcher.
A legitimate Adobe executable named "biz_helper.exe" contained a rogue DLL ("libcef.dll") that utilized the Duplex Message Transport Protocol (DMTP) for command-and-control (C2), allowing the client to execute and orchestrate plugins from an attacker-controlled server to facilitate persistence or data collection. ESET noted that SlippyNunchucks targeted organizations and individuals across multiple sectors, including an organization operating Chinese-language online betting platforms in Sri Lanka, Hong Kong, and the Philippines.
The surveillance activity against this organization was significant given China's restrictions on gambling, including criminal penalties for operating gambling businesses and organizing Chinese citizens to gamble abroad. "The vulnerability combines three separate weaknesses into a single, one-click exploit: unvalidated command-line argument injection in the sgbiz: custom protocol handler, unrestricted URL navigation in a CEF-based WebView, and an outdated, unsandboxed Chromium browser engine that is susceptible to CVE-2021-38003," Gen Digital explained.
