Reported by 15 outlets
Hackers exploit Tencent app flaw to deploy GrayRabbit malware
Why this score
- Breadth
- 2.00 / 2.0 · 15 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 4.70 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
Gen Threat Labs disclosed CVE-2026-51990 on September 10, 2026 with evidence that UNC3569, a China-nexus contractor group Google has tracked since 2021, already used it: a crafted sgbiz: link triggers the biz_helper.exe protocol handler, which passes an unvalidated param argument to SGMyInput.exe, which navigates its skin-store webview to an attacker URL, and that webview is a CEF build of Chromium 80.0.3987.163 from March 2020 running with no sandbox, same-origin policy disabled, and file access enabled. The observed campaign needed no browser zero-day at all. The page at noht1ng[.]top served CVE-2021-38003, the V8 JSON.stringify type confusion fixed in Chrome 95.0.4638.69 in October 2021, publicly weaponized in STAR Labs' December 2022 write-up and on CISA's KEV list since November 3, 2021. A 921-byte downloader shellcode then fetched 7z.exe, a trojanized 7z.dll, and an encrypted payload from 8.218.50[.]207 and sideloaded the GRAYRABBIT backdoor out of C:\Users\Public\Documents.
The exploitable primitive is a six-years-patch-starved browser wired to one click, so the barrier to entry is a public PoC, not a zero-day budget, and any of the dozens of V8 bugs published since March 2020 is a candidate payload slot. Success means the full GRAYRABBIT command set on the victim: silent process execution, interactive reverse shell, bidirectional file transfer, and in-memory plugin loading, over RC4-encrypted raw TCP to mail.uaiubifas[.]top on port 443, a port where plaintext traffic hides inside what monitoring assumes is TLS. Scale is what separates this from routine adware: Citizen Lab put the app at 455 million monthly users and roughly 70 percent of the Chinese input-method market in 2023, the same report that showed its traffic handling already leaks what users type, so a state-linked implant inside it is a targeted-surveillance capability at population scale. The detail the event list does not spell out: the April 2026 fix in version 16.3.0.3498 only closed the protocol-handler front door, and Gen verified the embedded browser still ships sandboxless with its security switches hardcoded on, meaning the soft core remains one future argument-injection bug away from one-click RCE on fully patched hosts. Tencent called the chain relatively complex and leaned on the authorization prompt; that is a dispute about friction, not about whether the exploitation happened.
Inventory Windows fleets for Sogou Input Method and require 16.3.0.3498 or later, noting that neither vendor published how to check the installed version, so auto-update status should be verified rather than assumed. Hunt the artifacts regardless of patch state, because the loader self-deletes through an NTFS alternate data stream and an absent DLL proves nothing: SHA256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 for the 7z.dll loader, 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e for the payload file p, d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a for GRAYRABBIT core.dll, plus 7z.exe, 7z.dll, and p under C:\Users\Public\Documents and 7z.exe loading a library from its own directory. On the network, alert on mail.uaiubifas[.]top, noht1ng[.]top, and 8.218.50[.]207, and flag port-443 sessions with no TLS handshake, since the backdoor's frames are fixed 4096-byte RC4 records over raw sockets with keepalives at 10 seconds. In endpoint telemetry, watch for SGMyInput.exe command lines containing -url= or -page=skincenter and for biz_helper.exe launches following sgbiz: URI invocations, and consider blocking that protocol handler by policy where the application is not required.
Two developments would change this assessment. Any Tencent move to harden, sandbox, or replace the CEF 80 component would retire the latent risk Gen flagged, while a second handler or navigation flaw would reopen one-click execution on patched machines with the same public V8 arsenal. Beyond the vendor, a KEV listing for CVE-2026-51990 would put federal remediation deadlines on an app most enterprise inventories have never tracked, and fresh campaigns reusing the GRAYRABBIT infrastructure, the uaiubifas[.]top and n[.]top domains with Alibaba Cloud Hong Kong staging, would show the browser path is an operational delivery route for UNC3569 rather than a one-off intrusion.
Timeline
-
original reporting
Hackers exploit Tencent app flaw to deploy GrayRabbit malware
bleepingcomputer.com · 30d ago · September 13th, 2026
Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. Researchers at cybersecurity company Gen Digital warn that the security issue is a one-click remote code execution (RCE) flaw. "We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link," Gen Threat Labs says . Sogou Input Method is a popular Windows application that lets users type Chinese characters using a standard keyboard and also offers a custom link handler and a built-in web browser using an outdated Chromium engine. Developed by Chinese tech giant Tencent, Sogou Input Method reportedly has hundreds of millions of installations in China. Gen Threat Labs reports that UNC3569 chains three weaknesses in the product: an unvalidated command-line argument injection in the sgbiz: URI an unrestricted URL navigation in a CEF-based webview an outdated, unsandboxed Chromium browser engine The attack chain starts with the victim clicking a crafted sgbiz: custom URI, causing Windows to invoke Sogou’s biz_helper.exe protocol handler, which passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without validating them. The attacker-injected arguments open Sogou’s skincenter component and instruct its embedded Chromium webview to load an attacker-controlled URL. Sogou do
-
update from cisa.gov
CISA KEV: CVE-2021-38003, Google Chromium V8
cisa.gov · 1806d ago · November 3rd, 2021
CISA added CVE-2021-38003, the Chromium V8 bug exploited in the Sogou attack chain, to the Known Exploited Vulnerabilities Catalog on November 3, 2021, per the KEV feed. The payload bug in the 2026 UNC3569 campaign has therefore been a documented, exploited vulnerability for almost five years, and Sogou's bundled Chromium 80 build never received the fix.
-
update from starlabs.sg
The Hole New World: How a small leak will sink a Great Browser (CVE-2021-38003)
starlabs.sg · 1408d ago · December 6th, 2022
STAR Labs published a full analysis with working exploit code for CVE-2021-38003, the V8 type confusion in JSON.stringify that Google fixed in Chrome 95.0.4638.69 in October 2021. The exploit technique described here, corrupting V8 Map structures into arbitrary read and write and then writing shellcode into RWX WebAssembly memory, is the same code path served to victims in the 2026 Sogou campaign, available publicly for nearly four years.
-
update from citizenlab.ca
"Please Do Not Make It Public": Vulnerabilities in Sogou Keyboard Encryption Expose Keypresses to Network Eavesdropping
citizenlab.ca · 1162d ago · August 9th, 2023
Citizen Lab's August 9, 2023 report found encryption flaws in Sogou Input Method that exposed keystrokes to network eavesdropping, and is the source for the product's scale: over 455 million monthly users across Windows, Android, and iOS, about 70 percent of the Chinese input-method market. The report establishes that this application was a known privacy weak point three years before an espionage group turned it into a remote code execution vector.
-
update from virusbulletin.com
Down the GRAYRABBIT Hole: Exposing UNC3569 and Its Modus Operandi (VB2024)
virusbulletin.com · 742d ago · October 2nd, 2024
Google researchers presented this paper on UNC3569 and GRAYRABBIT at Virus Bulletin 2024, held in Dublin on October 2 to 4, 2024, two years before the Sogou exploitation surfaced. It documents GRAYRABBIT as UNC3569's first-stage implant, the RABBITFUR downloader delivery pattern, and the group's operations for Google since 2021 against government, education, technology, and finance targets concentrated in East and Southeast Asia, with ties to the leaked Chinese contractor i-SOON.
-
update from gendigital.com
Gray Rabbits and the Tale of a One-Click Backdoor
gendigital.com · 34d ago · September 10th, 2026
The original Gen Threat Labs disclosure by Alexandru-Cristian Bardas, published a day before the story broke in trade press, documents CVE-2026-51990 and the in-the-wild UNC3569 GRAYRABBIT campaign. Gen reported the flaw to Tencent on April 9, 2026, got the fix in Sogou Input Method 16.3.0.3498 on April 21, 2026, and had CVE-2026-51990 assigned by MITRE on July 10, 2026; there is no separate public Tencent advisory, only this disclosure timeline. The post lists the full exploit chain, the SHA256 hashes of the 7z.dll loader, payload p, and core.dll, and the network indicators mail.uaiubifas[.]top, noht1ng[.]top, and 8.218.50[.]207.
-
mentioned by thehackernews.com
China-Linked UNC3569 Exploited Sogou Input Method Flaw to Deploy GRAYRABBIT Backdoor Indicators extracted from public reporting. Source: htt
thehackernews.com · 32d ago · September 11th, 2026
-
mentioned by cyberworldops.eu
Gen Digital reports China-linked UNC3569 exploited a code execution flaw in Sogou Input Method for Windows to deploy the GRAYRABBIT backdoor
cyberworldops.eu · 32d ago · September 11th, 2026
-
mentioned by thehackernews.com
🤖 China-linked UNC3569 exploited a Sogou Input Method link-handler flaw (CVE-2026-51990) to deploy the GRAYRABBIT backdoor. A crafted link r
thehackernews.com · 32d ago · September 11th, 2026
-
update from www.bleepingcomputer.com
Hackers exploit Tencent app flaw to deploy GrayRabbit malware https:// bleepingcomputer.com/news/security/ hackers-exploit-tencent-app-flaw-
www.bleepingcomputer.com · 30d ago · September 13th, 2026
Hackers exploit Tencent app flaw to deploy GrayRabbit malware https:// bleepingcomputer.com/news/security/ hackers-exploit-tencent-app-flaw-
via X https://www.bleepingcomputer.com/news/security/hackers-exploit-tencent-app-flaw-to-deploy-grayrabbit-malware/
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-51990 (critical): one-click RCE in Tencent's Sogou Input Method for Windows, actively exploited by UNC3569 to deploy the GrayRabb
www.bleepingcomputer.com · 30d ago · September 13th, 2026
-
mentioned by www.bleepingcomputer.com
A flaw in a Tencent application exploited to deploy GrayRabbit malware. The vector: a legitimate, widely distributed app
www.bleepingcomputer.com · 30d ago · September 13th, 2026
-
update from osintsights.com
Naturalists call this behavior "unpatched." It is, as with so many extinctions, entirely preventable. Update Sogou Input Method for Windows
osintsights.com · 30d ago · September 13th, 2026
Naturalists call this behavior "unpatched." It is, as with so many extinctions, entirely preventable.
-
mentioned by www.bleepingcomputer.com
🤖 China-aligned UNC3569 actively exploiting CVE-2026-51990, a critical one-click RCE in Tencent's Sogou Input Method for Windows, to deploy
www.bleepingcomputer.com · 30d ago · September 13th, 2026
-
update from securityonline.info
Defend against the CVE-2026-51990 Sogou exploit. Discover how hackers use this one-click flaw to drop backdoors and how to secure your syste
securityonline.info · 30d ago · September 14th, 2026
Discover how hackers use this one-click flaw to drop backdoors and how to secure your syste
via Mastodon https://securityonline.info/cve-2026-51990-sogou-exploit/?utm_source=mastodon&utm_medium=jetpack_social
-
mentioned by gbhackers.com
China-Linked Hackers Exploit Sogou One-Click RCE to Deploy GRAYRABBIT Backdoor
gbhackers.com · 29d ago · September 14th, 2026
-
mentioned by www.bleepingcomputer.com
🤖 CVE-2026-51990: threat actors tied to a China-aligned espionage group exploit a critical flaw in Tencent's Sogou Input Method for Windows
www.bleepingcomputer.com · 29d ago · September 14th, 2026
-
update from dev.to
1. Basic Information Original Title: Hackers exploit Tencent app flaw to deploy... # security # threatintel # software # coding # developmen
dev.to · 29d ago · September 14th, 2026
security # threatintel # software # coding # developmen
via Mastodon https://dev.to/anoymask/sogou-input-method-cve-2026-51990-one-click-rce-deploys-grayrabbit-4m0j
-
update from securityweek.com
Chinese Hackers Exploit Critical Tencent Software Flaw for One-Click Code Execution
securityweek.com · 29d ago · September 14th, 2026
It is a collection of executables that communicate using a custom protocol scheme named sgbiz . When a URL is opened, the protocol handler ( biz_helper.exe ) parses the URL and dispatches it to the appropriate component. According to Gen Threat Labs, the first issue existed because, during URL parsing, the protocol handler did not sanitize or validate the ‘ param ’ parameter, which controls the command-line arguments passed to the executable. This allowed an attacker to inject command-line arguments in the URL to declare a ‘skincenter’ page, which another function would simply copy and navigate the browser to. The next security hole goes deeper: the browser in Sogou Input Method is based on a Chromium 80 iteration released in March 2020 that is missing roughly six years of security patches, has the sandbox completely disabled, strips additional protections (including same-origin policy), and
-
mentioned by cyberworldops.eu
UNC3569 is exploiting CVE-2026-51990 in Tencent Sogou Input Method for Windows. A crafted sgbiz:// URL enables one-click SYSTEM-level code e
cyberworldops.eu · 29d ago · September 14th, 2026
-
mentioned by cyber.netsecops.io
📰 Chinese Hackers Exploit Critical Flaw in Tencent's Sogou IME Software A critical flaw (CVE-2026-51990) in Tencent's popular Sogou Input Me
cyber.netsecops.io · 28d ago · September 15th, 2026