A China-linked threat group is exploiting a critical Tencent Sogou Input Method vulnerability to deploy GrayRabbit malware. The one-click attack targets Windows users through specially crafted links and can lead to remote code execution.
Tracked as CVE-2026-51990, the vulnerability affects an application reportedly installed on hundreds of millions of systems in China. Tencent patched the flaw in April, although researchers say the software’s underlying browser still carries significant security risks.
UNC3569 Exploits One-Click Vulnerability
Gen Digital researchers observed the UNC3569 threat group exploiting CVE-2026-51990 in active attacks. The hackers used malicious links to install the GrayRabbit backdoor on targeted Windows computers.
Sogou Input Method helps users enter Chinese characters with a standard keyboard. In addition, the application includes a custom link handler and an integrated web browser based on an outdated Chromium engine.
The attack only requires a victim to click a specially crafted link. Therefore, threat actors can launch the entire infection chain with minimal user interaction.
Researchers linked UNC3569 to China and previously associated the group with both cybercrime and contractor-for-hire activity.
Attack Chains Three Security Weaknesses
UNC3569 combines three weaknesses in Sogou Input Method. These include command-line argument injection, unrestricted webview navigation and an outdated Chromium browser without sandbox protection.
First, the victim clicks a malicious link that uses Sogou’s custom sgbiz: URI scheme. Windows then launches the legitimate biz_helper.exe protocol handler.
The handler forwards attacker-controlled command-line arguments to the legitimate SGMyInput.exe application without validating them. Consequently, attackers can open Sogou’s skin centre and control its embedded Chromium webview.
Next, the injected arguments direct the webview to an attacker-controlled website. Sogou failed to restrict either the destination or the URL scheme used during this step.
Finally, the malicious website exploits a known vulnerability in the outdated Chromium 80 engine. The browser runs without a sandbox and has important web protections disabled. As a result, the exploit achieves code execution and installs GrayRabbit malware.
GrayRabbit Backdoor Gains New Capabilities
Security researchers previously described GrayRabbit as a modular malware family connected to UNC3569. However, the sample analysed in the latest campaign appears more mature than earlier versions.
The new 64-bit variant contains an expanded command set. It also protects its command-and-control configuration with RC4 encoding.
GrayRabbit malware can execute processes and open interactive reverse shells. Moreover, it can upload or download files and collect information about the victim’s system and user account.
The backdoor can also load additional plugins directly into the computer’s memory. This technique helps attackers expand its functionality while limiting traces written to storage.
Tencent Releases Security Update
Gen Threat Labs reported the vulnerability to Tencent on April 9. The company then addressed it in Sogou Input Method version 16.3.0.3498, released on April 21.
The update validates URL arguments passed through the custom protocol handler. It also permits only HTTPS connections and limits navigation to approved Sogou and Tencent domains.
Users should therefore install version 16.3.0.3498 or a newer release immediately. Organisations should also investigate unexpected launches of Sogou’s protocol handler and connections to unfamiliar websites.
However, the update does not resolve every concern. Researchers warned that the application still uses an outdated Chromium engine without sandboxing. Furthermore, the browser continues to operate with several important web security protections disabled.
0 responses to “Hackers Exploit Tencent Sogou Flaw to Deploy GrayRabbit Malware”