One click on a keyboard app: Sogou, GrayRabbit, and forgotten endpoint software

Not every serious endpoint compromise starts with email. Gen Digital published research in September on a one-click attack chain against Sogou Input Method for Windows, a popular Chinese-language keyboard tool with a huge install base. The China-linked group UNC3569 used it in the wild to deploy the GrayRabbit backdoor.

How the click becomes a backdoor

CVE-2026-51990 chains three weaknesses Gen Digital outlined: unvalidated arguments passed through the custom sgbiz: protocol handler, unrestricted navigation in an embedded Chromium webview, and an outdated Chromium 80 engine running without a sandbox and with several web security features turned off.

A victim clicks a crafted link. Windows invokes Sogou's biz_helper.exe, which forwards attacker-controlled arguments into SGMyInput.exe. That loads attacker content in the skin center webview. Exploitation in the ancient browser component yields code execution and GrayRabbit installation. From there the operator gets interactive shell access, file transfer, and plugin loading typical of a first-stage espionage tool.

Tencent fixed the protocol handler path in version 16.3.0.3498, rolled out via automatic update in April 2026 after Gen reported the issue on April 9. Public disclosure and CVE assignment followed later in the year. Researchers noted the embedded browser stack itself was largely unchanged as of early September, which leaves residual risk if another navigation bug appears.

Who should care outside East Asia

Global firms with developers, support staff, or executives who use multilingual input tools may have Sogou or similar IME software without IT awareness. Remote workers install utilities that never hit a corporate gold image. Incident responders who only hunt Outlook rules miss protocol handlers registered for consumer apps.

UNC3569 activity described by Google Threat Intelligence ties to government, education, technology, and finance targets across East and Southeast Asia. Espionage tradecraft does not stay regional forever. The lesson is universal: any always-on desktop helper with network access and scriptable URIs belongs in software inventory.

What to do on Windows estates

• Inventory input method editors, language packs, and vendor utilities on managed and BYOD devices where policy allows.
• Confirm Sogou builds are at 16.3.0.3498 or newer if the product is approved.
• Block or alert on unusual custom URI handlers where endpoint tooling supports it.
• Include consumer-grade utilities in phishing and user education, not only corporate SaaS logins.
• Treat IME and helper apps like browser extensions: high privilege, easy to overlook.

Bottom line

Endpoint security is still a story about what got installed while nobody was watching. Forensic Five runs assessments and external scans for Canadian organizations that need a sober picture of exposure. From St. Albert, Alberta. Plain language, scoped deliverables, no fear marketing.