Attackers linked to the UNC3569 espionage group are exploiting a critical vulnerability in Tencent’s Sogou Input Method for Windows application to deploy the GrayRabbit backdoor on victims’ devices. Gen Digital described the flaw, tracked as CVE-2026-51990, as a one-click remote code execution vulnerability and said that the attacks had been observed in the wild.
Sogou Input Method allows users to type Chinese characters using a standard keyboard. It also includes a dedicated link handler and an embedded browser based on an outdated Chromium engine. According to information from Gen Threat Labs, the application has hundreds of millions of installations in China, giving its exploitation potentially broad reach among Windows users.
How Was the Attack Carried Out?
The exploitation chain relies on combining three weaknesses in the application. The first is the unvalidated injection of command-line arguments through the custom sgbiz: scheme. The second is the ability to navigate to URLs without sufficient restrictions inside a CEF-based viewing window. The third is the use of an outdated and unsandboxed Chromium 80 engine.
The attack begins when the victim clicks a specially crafted sgbiz: link. Windows then invokes the biz_helper.exe file, which passes attacker-controlled arguments to the legitimate SGMyInput.exe file without validating them. These arguments cause the application’s skincenter component to open and then direct the embedded Chromium window to a page controlled by the attacker.
The malicious page exploits a known vulnerability in the outdated Chromium engine. Because the browser runs without a sandbox and several web-protection mechanisms are disabled, the attacker can execute code and install GrayRabbit on the device.
GrayRabbit’s Capabilities
Google researchers previously described GrayRabbit in 2024 as a modular malware family and linked it to UNC3569, a China-based threat actor active in cybercrime environments and cyber-contracting services. The sample analyzed by Gen Threat Labs is a more advanced 64-bit version, with an expanded command set and RC4-encrypted configuration for communicating with the command-and-control server.
The backdoor’s capabilities include process execution, opening interactive reverse-shell sessions, uploading and downloading files, collecting system and user information, and loading plugins directly into the device’s memory.
What Changed in Practice?
Gen Threat Labs notified Tencent of its findings on April 9, and the company released Sogou Input Method version 16.3.0.3498 on April 21. The update validates the URLs accepted by the protocol handler, permits HTTPS links only, and restricts browsing to approved domains associated with Sogou and Tencent.
However, the update does not remove all the risk elements identified by the researchers. The embedded browser engine remains outdated, and it continues to run without a sandbox while several web-protection mechanisms remain disabled. Therefore, the release addresses the path for passing an address through the protocol handler, but it does not fully resolve the problem of relying on an outdated browser environment with weak isolation.
The incident is significant because an application whose primary function is text input became an entry point for a multistage attack, and clicking a carefully crafted link was sufficient to start the chain. This demonstrates that updating the application is necessary, but does not eliminate the need to review the components embedded within it, particularly browser engines and isolation mechanisms.