A Chinese Typing App Used by Hundreds of Millions Had a One-Click Backdoor, and Microsoft Just Disclosed Two Separate Campaigns Hitting Cloud Accounts and Finance Teams at Once

A Single Crafted Link, and Hundreds of Millions of Machines at Risk

Start with the app most Western readers have never heard of, used by hundreds of millions of people every single day: Sogou Input Method, the dominant tool for typing Chinese characters on Windows using a standard keyboard. Researchers at Gen Digital's threat intelligence unit found a critical, one-click remote code execution flaw in the software while investigating a live intrusion by a group called UNC3569 — and traced the attacker's initial foothold back to something they weren't expecting: a process chain that started inside the typing app itself.

The vulnerability, tracked as CVE-2026-51990, chains three separate weaknesses together into something genuinely dangerous: unvalidated command-line argument injection in Sogou's own custom link handler, unrestricted URL navigation inside an embedded Chromium-based webview, and — the part that turns a bug into a real weapon — that embedded browser engine is Chromium 80, years out of date, running unsandboxed with none of the modern web security protections a current browser would have. A single crafted link, requiring nothing more than one click, was enough to reach code execution with the full privileges of the logged-in user. No exploit chain requiring multiple stages of user interaction, no attachment to open — just a link.

What UNC3569 actually did with that access is where this gets specific and instructive. Once inside, the exploit shellcode pulled down three files from a cloud server — including a legitimate, signed 7-Zip binary and a malicious accompanying DLL — and used binary sideloading, a technique where malicious code rides in alongside a trusted, legitimately-signed executable specifically to avoid tripping security software that trusts the signed binary. The payload loader checked the total running process count on the machine first, a simple but effective way to detect whether it had landed in an automated malware analysis sandbox rather than a real victim's computer, and only decrypted the final backdoor into memory if that check passed. That backdoor, GrayRabbit, is a small, well-worn tool UNC3569 has used for years — Google's own threat intelligence team has tracked the group since 2021 and places it in China's hacker-for-hire ecosystem, with a pattern of targeting government, education, technology, and finance organizations mostly across East and Southeast Asia. Once running, GrayRabbit reaches its command server over port 443 — the port normally reserved for encrypted HTTPS traffic — but sends its actual communication as plain TCP scrambled with RC4 instead of real TLS, a detail worth knowing directly: non-TLS traffic riding on port 443 is a genuinely useful, concrete signal for any organization's own network monitoring to watch for, regardless of whether Sogou itself is in your environment.

Gen reported the flaw to Tencent on April 9, and Tencent moved fast — a confirmed fix shipped twelve days later, on April 21, in version 16.3.0.3498, delivered automatically to users. The patch validates the URL arguments passed through the link handler, permits only HTTPS, and restricts navigation to a specific allowlist of Sogou and Tencent-owned domains. Worth being precise about what that patch does and doesn't cover, since Gen's own examination of the patched files found the deeper issue only partially addressed: the sandbox setting remains off, and the underlying Chromium 80 engine itself was never touched or updated. The specific exploit chain that let UNC3569 in is closed. The outdated, unsandboxed browser engine sitting underneath it is not. If your organization has any presence in markets where Sogou Input Method is common — or simply wants a live, current example of exactly what "outdated embedded Chromium engine" looks like as a real attack surface rather than an abstract risk — this is as clean a case study as they come.

Two Separate Microsoft Campaigns, Hitting Finance Teams and Cloud Accounts at Once

The second story of the day comes directly from Microsoft's own security research team, disclosing two distinct, simultaneously-running campaigns that together illustrate something worth sitting with: attackers are increasingly running parallel operations targeting completely different parts of an organization's trust surface at the same time, rather than betting everything on one single technique. The first, run between August 3 and 5, sent more than a million scam emails specifically targeting accounts payable departments, impersonating each victim company's own CEO, CFO, or president by name. Microsoft found clear evidence the operators used generative AI to draft the email templates and tailor each message to its specific recipient — the emails included a forwarded thread and a fabricated invoice, appearing to be correspondence between the impersonated executive and ServiceNow, requesting an Automated Clearing House transfer of nearly $50,000 for a supposedly legitimate annual subscription renewal. The campaign routed through legitimate third-party email delivery infrastructure rather than compromised Microsoft systems, and concentrated overwhelmingly on US organizations — 87.7% of the total volume — across IT services, consumer goods, real estate, and manufacturing specifically.

The second, separate campaign Microsoft disclosed in the same advisory uses passkey-themed social engineering — fraudulent prompts asking a user to "re-register" a passkey, or impersonated IT help-desk calls specifically built around passkey terminology — to trick victims into actions that hand attackers direct access to their cloud accounts. Microsoft describes activity dating back to May 2026 consistent with what it calls "automated collection from compromised cloud identities using proxy-associated infrastructure," with attackers adding their own MFA methods once inside to maintain persistent access, then abusing Microsoft Graph, SharePoint, OneDrive, and mailbox access to exfiltrate data at scale. One honest caveat worth stating plainly: Microsoft's own advisory doesn't confirm that both specific techniques were used together in a single, unified attack chain against the same victims — treat this as two related but distinct campaigns illustrating a shared category of risk, not necessarily one combined operation.

The throughline connecting both campaigns is the one worth taking into any security awareness planning this week: attackers are deliberately targeting whatever authentication method or business process a given organization already trusts the most, adapting the lure to match. Most phishing-awareness training still centers heavily on fake password-login pages — Microsoft's own practical recommendation is to specifically add passkey-themed lures to that training, since a "re-register your passkey" prompt or an impersonated help-desk call built around passwordless authentication is a genuinely different shape of trick than a classic fake login page, and most people haven't been shown what it looks like yet. On the finance side, the concrete, actionable step is auditing every third-party sender authorized in your organization's email flow and confirming DMARC is set to quarantine or reject rather than a weaker monitoring-only mode — since this campaign's entire delivery mechanism depended on trusted third-party infrastructure, not on breaking into Microsoft's own systems at all.

The Common Thread

Two stories from opposite sides of the world, converging on the same practical point: both relied on exploiting a specific, well-worn kind of trust rather than defeating strong technical defenses head-on. UNC3569 didn't need a sophisticated zero-day chain against Windows itself — it needed one link, one outdated embedded browser nobody had gotten around to fully sandboxing, and a signed binary victims' own security tools already trusted. Microsoft's disclosed campaigns didn't need to breach Microsoft's cloud infrastructure directly — they needed a CEO's name that sounded right, an invoice that looked plausible, and an authentication prompt shaped exactly like the passwordless login flow organizations have been actively encouraged to adopt. Neither attack needed to be technically exotic. Both needed defenders to have quietly stopped questioning something specific — an embedded app's browser engine, an email that used the right name, a login prompt shaped like the modern kind you're supposed to trust.

A quick, honest note on today's OT coverage specifically: a dedicated search for fresh operational-technology and industrial-control-system attacks turned up nothing genuinely new from the past 24 hours — mostly older trend reports and conference announcements rather than a live, current incident. Rather than force something stale into today's roundup, it's worth naming plainly and moving on; today's real, freshest stories were the two above.