Chinese Hackers Weaponised a Flaw in Tencent's Sogou to Drop a Backdoor on Hundreds of Millions of Potential Targets
A critical vulnerability in Sogou Input Method, the Tencent-developed typing software used by hundreds of millions of Chinese-language Windows users, has been actively exploited in the wild. The attackers deployed a backdoor through a single crafted link. That's it. One click.
Gen Threat Labs attributed the attacks to UNC3569, a China-linked threat group with suspected ties to private contractor i-SOON. The group has a track record of going after government, education, tech, and finance targets worldwide, and has been doing so with increasing sophistication.
The vulnerability, CVE-2026-51990, is actually three separate failures stacked on top of each other. First, Sogou's custom protocol handler, biz_helper.exe, which manages URLs using the sgbiz scheme, doesn't bother validating a parameter called 'param' that controls which arguments get passed to executables. An attacker can simply inject whatever they want into that field.
Second, once injected, those arguments can declare a 'skincenter' page that an internal function will obediently navigate the browser to, no questions asked.
Third, and this is where it gets embarrassing, the browser bundled inside Sogou is built on Chromium 80. That version shipped in March 2020. It's missing around six years of security patches, runs with the sandbox entirely disabled, strips out protections including the same-origin policy, and happily reads local files via URL. Chromium 80 was already a concern before lockdowns were a thing. Shipping it in 2025 without a sandbox is basically leaving a window open.
Chain those three weaknesses together and you get system-level code execution delivered through a link. UNC3569 used crafted sgbiz URLs to do exactly that, dropping the GrayRabbit backdoor on victims who clicked.
GrayRabbit is not new. Gen Threat Labs has tracked it across UNC3569 intrusions since at least 2021. It provides a reverse shell and comes with a fairly complete toolkit: process execution, plugin loading, file uploads to command-and-control infrastructure, system reconnaissance, and a self-termination function for when the operators want to clean up.
Gen Threat Labs reported the flaw to Tencent on April 9. A fix arrived in Sogou Input Method version 16.3.0.3498, pushed out via automatic update. The patch adds a check for URL-bearing switches in the protocol handler, which addresses the injection vector.
What it doesn't address is the ancient, sandboxless Chromium sitting underneath all of this. As of September 10, according to Gen Threat Labs, that configuration remains untouched. So the most structurally alarming part of the vulnerability chain is still there, just currently unreachable through the patched entry point.
For now.