Attackers tied to a China-aligned espionage group are using a critical flaw in Tencent's Sogou Input Method for Windows to install the GrayRabbit backdoor, according to researchers at cybersecurity company Gen Digital. Gen Threat Labs said the vulnerability, tracked as CVE-2026-51990, is a one-click remote code execution issue that has been exploited in the wild. The group behind the campaign is identified as UNC3569. Sogou Input Method is a widely used Windows application that allows users to type Chinese characters with a standard keyboard and includes a custom link handler and a built-in browser based on an outdated Chromium engine. Tencent, the Chinese technology company that develops the software, reportedly has hundreds of millions of installations in China.
Gen Threat Labs described an attack chain that combines three weaknesses in the product. It begins when a victim clicks a crafted sgbiz: custom URI, which causes Windows to launch Sogou's biz_helper.exe protocol handler. That handler passes command-line arguments controlled by the attacker to the legitimate SGMyInput.exe executable without checking them. The injected arguments then open Sogou's skincenter component and direct its embedded Chromium webview to load a URL chosen by the attacker, with no restriction on the URL's scheme or destination.
In the third stage, a malicious page takes advantage of a known vulnerability in Sogou's outdated Chromium 80 engine. Because that browser runs without a sandbox and with key web security protections turned off, the exploit achieves code execution and installs the GrayRabbit backdoor, according to the researchers.
Google researchers described GrayRabbit in 2024 as a modular malware family and linked it to UNC3569, which the source describes as a China-based threat actor active in both the cybercrime and cyber contractor-for-hire ecosystems. The sample Gen Threat Labs examined is a more mature 64-bit variant with a broader command set and an RC4-encoded command-and-control configuration. Its capabilities include running processes, opening interactive reverse shells, uploading and downloading files, gathering system and user information, and loading plugins reflectively into the host's memory.
Gen Threat Labs said it reported the findings to Tencent on April 9, and the vendor shipped a fix in Sogou Input Method version 16.3.0.3498, released on April 21. The patch validates the URL arguments accepted through the protocol handler, allows only HTTPS, and limits navigation to approved Sogou and Tencent domains. The researchers cautioned, however, that the underlying browser remains outdated and still runs without a sandbox, with many web security protections disabled.
More cybersecurity news from TechManNews.
