LmCast :: Stay tuned in

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Recorded: Sept. 13, 2026, 3 p.m.

Original Summarized

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

News

Featured
Latest

Passkey-themed phishing attacks lead to Microsoft 365 data theft

Artifactory flaws chained in attacks deploying backdoor malware

Trezor: 347,000 users targeted in phishing attacks after Brevo breach

September Windows Server updates break Remote Desktop Services

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Stick with the language lessons that come from linguists in this app deal

Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent

Get 3 years of Surfshark VPN for $67.19 in this deal

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityHackers exploit Tencent app flaw to deploy GrayRabbit malware

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

By Bill Toulas

September 13, 2026
10:26 AM
0

Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor.
Researchers at cybersecurity company Gen Digital warn that the security issue is a one-click remote code execution (RCE) flaw.
"We observed this vulnerability actively exploited in the wild by the UNC3569 threat group to deploy the GRAYRABBIT backdoor through a crafted link," Gen Threat Labs says.
Sogou Input Method is a popular Windows application that lets users type Chinese characters using a standard keyboard and also offers a custom link handler and a built-in web browser using an outdated Chromium engine.
Developed by Chinese tech giant Tencent, Sogou Input Method reportedly has hundreds of millions of installations in China.
Gen Threat Labs reports that UNC3569 chains three weaknesses in the product:
an unvalidated command-line argument injection in the sgbiz: URI
an unrestricted URL navigation in a CEF-based webview
an outdated, unsandboxed Chromium browser engine
The attack chain starts with the victim clicking a crafted sgbiz: custom URI, causing Windows to invoke Sogou’s biz_helper.exe protocol handler, which passes attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without validating them.
The attacker-injected arguments open Sogou’s skincenter component and instruct its embedded Chromium webview to load an attacker-controlled URL. Sogou does not restrict the URL’s scheme or destination.
In the third stage, a malicious page exploits a known vulnerability in Sogou’s outdated Chromium 80 engine. Because the browser runs without a sandbox and with important web-security protections disabled, the exploit achieves code execution and installs the GrayRabbit backdoor.

The UNC3569 attack chainSource: Gen Threat Labs
In 2024, Google researchers described GrayRabbit as a modular malware family and linked it to UNC3569, a China-based threat actor operating across both the cybercrime and cyber contractor-for-hire ecosystems.
The malware sample that Gen Threat Labs analyzed is a more mature 64-bit variant with an expanded command set and RC4-encoded command-and-control (C2) configuration.
Its capabilities include process execution, opening interactive reverse shells, uploading and downloading files, collecting system and user information, and reflectively loading plugins in the host’s memory.
Gen Threat Labs reported their findings to Tencent on April 9, and the software vendor deployed a fix in Sogou Input Method version 16.3.0.3498, released on April 21.
The patch validates the URL arguments accepted through the protocol handler, permits only HTTPS, and restricts navigation to approved domains related to Sogou and Tencent.
However, the researchers warned that the underlying browser remains outdated and still runs without a sandbox, with many web security protections disabled.

Build your security blueprint for AI-powered attacks

Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Save your seat

Related Articles:
New Dysphoria DDoS botnet spreads to 200k devices worldwideArtifactory flaws chained in attacks deploying backdoor malwareAI-powered attack exploited PaperCut flaws to hack 395 organizationsCisco FMC flaws exploited by ransomware gang, state-sponsored hackersNew 'BlueMoon' kit exploited Windows and Chrome zero-day flaws

Actively Exploited
China
Chromium
GrayRabbit
Malware
Tencent
UNC3569

Bill Toulas
Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks.

Previous Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

  Upcoming Webinar

Popular Stories

September Windows Server updates break Remote Desktop Services

Microsoft Excel KB5002914 update breaks copy and paste for some users

New Android malware encrypts files, steals data, and harasses victims

Sponsor Posts

Overdue a password health-check? Audit your Active Directory for free

EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain

Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. 

Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday.

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Threat actors associated with a China-aligned espionage group have utilized a critical vulnerability, identified as CVE-2026-51990, within Tencent’s Sogou Input Method for Windows to successfully deploy the GrayRabbit backdoor. Researchers from Gen Threat Labs warned that this security issue constitutes a one-click remote code execution remote code execution flaw.

The vulnerability was exploited in a multi-stage attack chain by the threat group UNC3569. This chain leveraged three distinct weaknesses in the Sogou Input Method application. First, the attack involved an unvalidated command-line argument injection within the sgbiz: URI protocol handler. Second, an unrestricted URL navigation mechanism existed within the CEF-based webview component. Third, the system relied on an outdated and unsandboxed Chromium browser engine. The initial stage of the attack began when a victim clicked a specially crafted sgbiz: custom URI, which caused Windows to invoke Sogou’s biz_helper.exe protocol handler. This handler incorrectly passed attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without performing necessary validation. Subsequently, these injected arguments were used to instruct Sogou’s skincenter component to load an attacker-controlled URL within the embedded Chromium webview. Crucially, Sogou failed to restrict the scheme or destination of this navigation. In the third stage, a malicious page hosted at the specified URL exploited a known vulnerability within Sogou’s outdated Chromium 80 engine. Because this browser environment operated without a sandbox and lacked essential web security protections, the exploit successfully achieved code execution, allowing the attackers to install the GrayRabbit backdoor onto the system.

The GrayRabbit malware sample analyzed by Gen Threat Labs was found to be a more mature 64-bit variant featuring an expanded command set and command-and-control configuration protected by RC4 encoding. Its functional capabilities are extensive, including the ability to execute processes, establish interactive reverse shells, facilitate file uploads and downloads, gather system and user information, and reflectively load plugins into the host’s memory.

In response to these findings, Gen Threat Labs reported their analysis to Tencent, leading the software vendor to deploy a remediation. Tencent released a fix in Sogou Input Method version 16.3.0.3498. This patch addressed the exploitation vector by validating the URL arguments accepted through the protocol handler, restricting navigation strictly to HTTPS, and limiting navigation destinations to domains approved by Sogou and Tencent. Nevertheless, the researchers cautioned that despite this patch, the underlying browser structure remains outdated, operating without a sandbox and with many critical web security protections still disabled.