deep

[DEEP RESEARCH] The Keyboard's Promotion Feed Became an Execution Path

Sogou's fix closes the documented injection path. Separate that repair from host cleanup and the next application-approval decision.

The icon department has requested executable privileges.

A Windows input method needs to turn keystrokes into Chinese text. Its promotional icons do not need to choose which code runs next.

ESET's November 4 investigation describes SlippyNunchucks, an actor it assesses as China-aligned, delivering the DarkVigil implant through Sogou Input Method's brand-promotion mechanism. DNS manipulation redirected an unencrypted configuration request; the substituted response drove downloads and file placement into paths used for component execution. ESET dates the observed Sogou activity to July 1—not disclosure week. [1]

Our judgment: Preserve required Chinese-language input, move affected installations to the fixed supported build, and make any broader approval depend on evidence about what remote promotional content can still instruct the application to do.

Version 16.10 addresses the reported delivery weakness. That is a reason to update, not proof of endpoint cleanup or an audit of every remote feature. [1, 2]

The checksum checked the attacker's homework

The useful detail is not simply that a trusted application downloaded malware. It is how much authority the downloaded configuration exercised.

ESET describes a response that could select files, supply their MD5 values, and direct their placement. SlippyNunchucks used that authority to deliver a signed Adobe executable and a malicious libcef.dll; existing Sogou component workflows provided the route to DLL side-loading. The executable's valid signature did not make its neighboring DLL trustworthy. [1]

Replacing the supplied checksum with one matching the attacker's file satisfied a consistency check. It did not establish who authorized the file. Even a stronger hash would not solve that trust problem if the attacker could replace both artifact and expected value.

There is a useful first check here: compare a suspect Sogou component's signer, original filename and hash with the approved package. An Adobe-signed executable masquerading as a Sogou component deserves investigation even though its signature verifies. A familiar filename alone proves much less.

The continuation separates three jobs: decide what can stay installed, test the repaired feature without weakening its protections, and investigate earlier exposure without turning every update event into an intrusion.