[SIGNALS WEEKLY] Follow the Access Path, Not the AI Label

The fast read

The delivery route changed. The actor label should not change by assumption. ESET reports that SlippyNunchucks, which it tracks separately from Mustang Panda, shifted from a QuickFox supply-chain compromise to abusing Sogou Input Method to deliver DarkVigil implants.[1] For teams with plausible application exposure, that is this week’s strongest lead: find what ran and where it came from before importing another group’s playbook.

Microsoft's reporting adds a second priority: agentic tools repeatedly seeking credentials for AI services.[2] Its Q3 email review is a lower-ranked retrospective; its sleeper-agent research is a laboratory result, not an observed campaign.[3][4]

SlippyNunchucks: keep the actor boundary and follow the application

ESET assesses with high confidence that SlippyNunchucks supports a nation-state surveillance effort aligned with Chinese government interests. It reports activity since 2025 reaching Chinese-speaking users abroad, particularly in Asia and Europe.[1] The reporting is new this week; the campaign is not.

The attribution distinction matters. ESET says its telemetry has revealed no overlap between DarkVigil-related activity and Mustang Panda activity, and it tracks SlippyNunchucks independently with no known associations.[1] That is ESET's assessment, not proof that an association is impossible. Importing Mustang Panda assumptions would discard the distinction the source is asking us to preserve.

The route is more useful than the label alone: ESET reports that SlippyNunchucks shifted to Sogou abuse after the QuickFox supply-chain compromise ended.[1] That supports checking relevant software and distribution history. It does not establish that every named application suffered a vendor supply-chain breach, or that an installed copy is compromised.

A useful first test is an unexplained chain from application execution or update activity to a new executable, persistence or outbound connection. This is our untested investigation hypothesis, not a published DarkVigil signature. It needs process ancestry, file and network records, software history, and signing or provenance data. Legitimate updating or promotion can produce similar activity; compare approved behavior before escalating a coherent suspicious chain. Language or software presence alone is not a compromise finding.

An installed application is a starting point, not a verdict. Escalate on the unexplained delivery chain and suspicious artifacts, not the language its user speaks. Campaign-specific delivery detail would sharpen that investigation; the present evidence does not justify treating a product list as a breach list.

The members’ continuation follows the next investigation: which credential changes and service use belong together, what an email-only view misses, and which new evidence would change the priority.

Follow credentials through to the service they unlock

A credential change can look routine until the same identity starts using resources its owner cannot explain. Following that connection is more useful than arguing over the AI label.