Sogou

Sogou Keyboard App Users Infected with Malware via DNS Hijacking

Users of the popular Chinese keyboard application Sogou have again become targets of malware attacks, this time executed through DNS hijacking according to researchers at ESET. The attackers exploited the application's use of unencrypted HTTP communication to intercept and modify update requests, forcing victims to download and execute malicious payloads. ESET identified infections in Hong Kong, Thailand, Japan, Vietnam, Sri Lanka and Oman starting on 1 July and notified developer Tencent on 11 September. Tencent released a patched version 16.10 on 30 October that switched all requests to HTTPS and implemented certificate pinning. The incident follows earlier attacks on Sogou users, including a September backdoor campaign and a 2022 man-in-the-middle operation also reported by ESET. The delivered malware gathers system information and can install additional payloads on compromised Windows systems.