Hackers exploit Tencent app flaw to deploy GrayRabbit malware
Recorded: Sept. 13, 2026, 3 p.m.
| Original | Summarized |
Hackers exploit Tencent app flaw to deploy GrayRabbit malware News Featured Passkey-themed phishing attacks lead to Microsoft 365 data theft Artifactory flaws chained in attacks deploying backdoor malware Trezor: 347,000 users targeted in phishing attacks after Brevo breach September Windows Server updates break Remote Desktop Services Hackers exploit Tencent app flaw to deploy GrayRabbit malware Stick with the language lessons that come from linguists in this app deal Dutch NCSC: Critical Check Point VPN flaws exploitation is imminent Get 3 years of Surfshark VPN for $67.19 in this deal Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityHackers exploit Tencent app flaw to deploy GrayRabbit malware Hackers exploit Tencent app flaw to deploy GrayRabbit malware By Bill Toulas September 13, 2026 Threat actors linked to a China-aligned espionage group are exploiting a critical vulnerability (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The UNC3569 attack chainSource: Gen Threat Labs Build your security blueprint for AI-powered attacks Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed. Related Articles: Actively Exploited Bill Toulas Previous Article Post a Comment Community Rules You need to login in order to post a comment Not a member yet? Register Now You may also like: Upcoming Webinar Popular Stories September Windows Server updates break Remote Desktop Services Microsoft Excel KB5002914 update breaks copy and paste for some users New Android malware encrypts files, steals data, and harasses victims Sponsor Posts Overdue a password health-check? Audit your Active Directory for free EtherHiding Malware on macOS: How Attackers Hide C2 on the Blockchain Find your gaps before an auditor does. Check your EU CRA readiness in 5 questions. Stay one step ahead of new threats in the new year. Join Huntress for the monthly Tradecraft Tuesday. Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Threat actors associated with a China-aligned espionage group have utilized a critical vulnerability, identified as CVE-2026-51990, within Tencent’s Sogou Input Method for Windows to successfully deploy the GrayRabbit backdoor. Researchers from Gen Threat Labs warned that this security issue constitutes a one-click remote code execution remote code execution flaw. The vulnerability was exploited in a multi-stage attack chain by the threat group UNC3569. This chain leveraged three distinct weaknesses in the Sogou Input Method application. First, the attack involved an unvalidated command-line argument injection within the sgbiz: URI protocol handler. Second, an unrestricted URL navigation mechanism existed within the CEF-based webview component. Third, the system relied on an outdated and unsandboxed Chromium browser engine. The initial stage of the attack began when a victim clicked a specially crafted sgbiz: custom URI, which caused Windows to invoke Sogou’s biz_helper.exe protocol handler. This handler incorrectly passed attacker-controlled command-line arguments to the legitimate SGMyInput.exe executable without performing necessary validation. Subsequently, these injected arguments were used to instruct Sogou’s skincenter component to load an attacker-controlled URL within the embedded Chromium webview. Crucially, Sogou failed to restrict the scheme or destination of this navigation. In the third stage, a malicious page hosted at the specified URL exploited a known vulnerability within Sogou’s outdated Chromium 80 engine. Because this browser environment operated without a sandbox and lacked essential web security protections, the exploit successfully achieved code execution, allowing the attackers to install the GrayRabbit backdoor onto the system. The GrayRabbit malware sample analyzed by Gen Threat Labs was found to be a more mature 64-bit variant featuring an expanded command set and command-and-control configuration protected by RC4 encoding. Its functional capabilities are extensive, including the ability to execute processes, establish interactive reverse shells, facilitate file uploads and downloads, gather system and user information, and reflectively load plugins into the host’s memory. In response to these findings, Gen Threat Labs reported their analysis to Tencent, leading the software vendor to deploy a remediation. Tencent released a fix in Sogou Input Method version 16.3.0.3498. This patch addressed the exploitation vector by validating the URL arguments accepted through the protocol handler, restricting navigation strictly to HTTPS, and limiting navigation destinations to domains approved by Sogou and Tencent. Nevertheless, the researchers cautioned that despite this patch, the underlying browser structure remains outdated, operating without a sandbox and with many critical web security protections still disabled. |