GoKawiilChinese hackers exploit Tencent's Sogou Input flaw to plant GrayRabbit backdoor
Gen Digital researchers found the China-linked group UNC3569 actively exploiting a one-click remote code execution bug (CVE-2026-51990) in Tencent's Sogou Input Method for Windows, an app used by hundreds of millions in China. Attackers chain a malicious sgbiz: link, an unrestricted browser navigation flaw, and an outdated, unsandboxed Chromium 80 engine to silently install the GrayRabbit backdoor once a victim clicks a crafted link.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw shows how legitimate, widely trusted software with embedded outdated browser components can become a stealthy espionage vector, requiring no more than a single click from the target. Because Sogou Input is deeply embedded in Chinese-language computing, the exploit chain gives state-linked actors a scalable way to compromise high-value targets without triggering typical malware defenses.
- A one-click flaw in Tencent's Sogou Input Method enables full remote code execution.
- UNC3569 chains three separate weaknesses, including an outdated, unsandboxed Chromium 80 engine, to deploy GrayRabbit.
- The case highlights risks of legacy embedded browsers in mainstream consumer software being weaponized for espionage.
Bitdefender Total Security — When attackers weaponize a one-click link to drop a backdoor, layered endpoint protection matters. Bitdefender Total Security covers Windows PCs with real-time malware scanning and web/link protection, exactly the kind of defense that helps when a trusted app's URI handler turns hostile.
See Bitdefender Total Security on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-13
Published there as: “Hackers exploit Tencent app flaw to deploy GrayRabbit malware”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.