GoKawiilChinese hackers exploit Tencent's Sogou Input flaw to plant GrayRabbit backdoor
Gen Digital researchers found the China-linked group UNC3569 actively exploiting a one-click remote code execution bug (CVE-2026-51990) in Tencent's Sogou Input Method for Windows, an app used by hundreds of millions in China. Attackers chain a malicious sgbiz: link, an unrestricted browser navigation flaw, and an outdated, unsandboxed Chromium 80 engine to silently install the GrayRabbit backdoor once a victim clicks a crafted link.