China-linked hackers exploited Tencent’s Sogou app to plant GrayRabbit backdoor

A China-linked espionage group tracked as UNC3569 was caught exploiting a critical vulnerability in Tencent’s Sogou Input Method for Windows to silently install the GrayRabbit backdoor on targeted machines. The attack required nothing more than a victim clicking a crafted link, according to research published by Gen Digital and reported by The Hacker News.

Sogou Input Method is one of the most widely used Chinese-language input tools, with hundreds of millions of installations. Its broad deployment in government, education, finance, and technology sectors across East and Southeast Asia made it an attractive initial-access vector for the group, which Google Threat Intelligence has tracked since 2021 and associates with China’s hacker-for-hire ecosystem.

Three flaws chained into a one-click compromise

The attack exploited CVE-2026-51990, a vulnerability rooted in Sogou’s custom sgbiz: URI handler. When a user clicked a malicious link, the handler passed unvalidated arguments to biz_helper.exe, which launched the app’s settings program and opened an attacker-controlled URL in an embedded webview.

That webview ran on Chromium 80 — released in March 2020 — without any sandbox protections. The attackers weaponized CVE-2021-38003, a previously known V8 engine exploit, to execute arbitrary JavaScript inside that unsandboxed environment and deliver the GrayRabbit payload. The three-stage chain — URI injection, unrestricted webview navigation, and an outdated browser engine — turned a single link click into a full system compromise.

What GrayRabbit does once inside

GrayRabbit is a lightweight but capable first-stage implant that UNC3569 has used across multiple campaigns. Once installed, it gives attackers a remote command shell, bidirectional file transfer, system and user information collection, and the ability to reflectively load additional modules from the attacker’s command-and-control server at any time. Its modular design means the initial foothold can be quietly upgraded to a full-featured espionage toolkit without triggering additional installation events.

Patch timeline and current status

Gen Digital reported the vulnerability to Tencent, which fixed it within 12 days. Version 16.3.0.3498, released April 21, 2026 and pushed to all users via automatic update, validates URLs, enforces HTTPS, and restricts the webview’s navigation to four approved domains. However, researchers note that the underlying Chromium 80 engine remains outdated and unsandboxed — a structural risk that persists beyond this specific CVE.

Organizations running the Sogou Input Method should verify they are on version 16.3.0.3498 or later. Given UNC3569’s focus on government and financial institutions in Asia, security teams in those sectors should treat any pre-patch exposure as a potential compromise and conduct forensic review of affected endpoints.