China Hacked the Software that Reads Every Key You Press
a china-linked group compromised a piece of software not generally associated with cyber attacks. UNC3569, a china-nexus activity cluster being tracked by google, targeted the sogou input method editor (ime). this is one of the most widely used chinese-typing tools on windows, owned by tencent.
the flaw, cve-2026-51990, opened the path to remote code execution through sogou's embedded browser. in the attack gen observed, UNC3569 chained it with an old chromium v8 flaw. one crafted link, one click, and the attacker could essentially do anything the currently logged-in user could do.
if you are unfamiliar with an ime, it is not an app you open and close. it sits resident in the background, running constantly, processing the text you type, because that is its entire job. it has deep, persistent, trusted access to the system by design. and almost nobody, not users, not most security teams, thinks of it as a piece of software that can be attacked. that is exactly what makes it a beautiful target. the more invisible and trusted a component is, the less anyone is watching it.
in this instance, the threat actor used grayrabbit as the payload. this is a backdoor UNC3569 has leaned on for years. it opens a remote shell, moves files in and out, and pulls down more tools on command.
one detail worth noting for defenders. it talks to its server on port 443, the port normally used for tls web traffic. however, this time the traffic is not actually encrypted the standard way. it is rc4-scrambled raw tcp riding on port 443 instead of tls. non-tls traffic on 443 is a quiet tell that something is wrong.
to tencent's credit, the response was fast. reported april 9, fixed and auto-pushed to all users by april 21. twelve days. that is how responsible disclosure is supposed to work, and it mostly closed the door.
but the room behind the door is still ugly. gen found the embedded browser remained chromium 80, still ran without a sandbox, and still had major browser security controls disabled after the fix.
the grayrabbit loader self-deletes. this means the malicious file may already be gone from the disk of a compromised machine, making it harder to know if you were hit. no one has confirmed whether installing the patch removes a backdoor already running. and tencent never said which versions were vulnerable or how to check the one you have. so the fix stops new infections, but anyone compromised before april 21 is left without a clear way to know it, or even clear it.
what is the lesson here? we spend our attention guarding the doors we can see. apps like the browser, the email client, the productivity suite. but in rare cases like this the actual way in was a piece of software so mundane nobody thought to look at it. an input method editor is trusted, invisible, and everywhere, and that combination is precisely what an attacker salivates over. the software you never think about is the software nobody is defending.
the most dangerous software on your machine may not be the thing you installed to do something. it may be the thing you forgot was there because it has been trusted for so long nobody remembers to question it. trust is not a security control. sometimes it is the vulnerability.
