Windows users who have installed the Chinese-language typing tool Sogou Input Method were exposed to a serious backdoor threat that required just one click to activate. Attackers deployed a chain of three distinct vulnerabilities that led straight into GRAYRABBIT, a known backdoor tool, without the usual warning signs or elaborate setup.
The campaign, tied to the UNC3569 threat group, was found by security researchers during an active intrusion case. It relied on a rarely-patched Windows protocol handler in Sogou that mishandles a custom link type called sgbiz. Normally this opens Sogou’s components via its helper program bizhelper.exe. But in this exploit, attackers appended malicious parameters that the system did not filter properly, allowing them to fire up the embedded browser in Sogou’s skin marketplace app and direct it to attack-controlled websites.
How the Attack Works
Sogou’s skin marketplace runs an internal Chromium-based browser—you know, a component that’s as risky as a frozen code state when left unpatched. The version in this case dated back to Chrome 80 (from 2020), and crucial sandbox protections were turned off. This meant attackers could use a known exploit (tracked as CVE-2021-38003 in Chrome’s V8 engine) to break out of the browser’s limited environment and execute code as if they were the signed-in user. Then came DLL sideloading, which camouflages malware as regular Windows files and makes detection way harder.
The backdoor involved is GRAYRABBIT. Once inside, it provides remote control: it can gather system info, execute commands, open shells, move files, load modules, and connect back to its command-and-control server. It was weaponized via an email, message or web link—no need for fake installers or multi-step social engineering.
Patch Status and Risk Management
Sogou developer Tencent was notified of the issue—identified as CVE-2026-51990—and pushed out a fix in version 16.3.0.3498. That update blocks malicious URL parameters at the protocol handler level, allowing only HTTPS addresses matching approved hostnames. Still, the embedded browser component remains problematic: it’s outdated, unsandboxed, and configured with web protection features disabled.
Users should verify they’re running version 16.3.0.3498 or higher and keep updates enabled. Security teams should scan for unusual process launches linked to Sogou components, check for unexpected child processes and outbound connections, and apply URL filtering. Historical logs should be reviewed using threat intelligence indicators provided by researchers—URLs, domains, IPs and the SHA-256 hashes of DLLs and payloads are all part of what to look for.
This attack proves how a single misstep—clicking what looks like a harmless link—can compromise systems via trusted but vulnerable applications. Especially when threats leverage internal browser engines or legacy components, even those widely used can turn into attack vectors.
What this means: protocol handlers, internal browsers, and URL filtering deserve serious attention in enterprise security strategies. Any trusted application that embeds browser engines must be audited for sandbox and update practices. We’ll be watching to see whether Tencent issues follow-up fixes, and whether threat actors begin reusing this pattern with other input tools or browser wrappers.
