Threat actors are exploiting a critical vulnerability in Tencent's Sogou Input Method for Windows to deploy the GrayRabbit backdoor. The vulnerability, reported as CVE-2026-51990, is being exploited by actors linked to a China-aligned espionage group. Successful exploitation may result in unauthorized access and control of affected systems. As of the report, specific patch details and the full exploitation vector have not been disclosed. Users are advised to update Sogou Input Method to the latest version and monitor official Tencent security advisories.

What should defenders do?

Users of Tencent's Sogou Input Method for Windows should update the application to the latest available version immediately. It is recommended to monitor official Tencent security advisories for patch releases and further technical details. Administrators should enforce update policies and consider temporary deployment restrictions if immediate updating is not feasible. Users should remain vigilant for unusual system behavior and apply network segmentation where possible to limit potential impact.

highZero-Day

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Critical vulnerability in Sogou Input Method for Windows actively exploited to deploy backdoor

CyberIntel DeskPublished 17 days agoUpdated less than a minute ago1 min read

Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Key Takeaways

A critical vulnerability (CVE-2026-51990) in Tencent's Sogou Input Method for Windows is being actively exploited.
Threat actors linked to a China-aligned espionage group are deploying the GrayRabbit backdoor via this flaw.
The exploitation is occurring in the wild, but specific exploitation details and patch information are not yet fully disclosed.
Users should update Sogou Input Method to the latest version and monitor official Tencent security advisories.

Related Security News

highCyber Attacks

Star Blizzard Campaign Targets 100+ Organizations with Fake Event Invitations

Microsoft reports that the Russian state-sponsored threat actor Star Blizzard has been conducting a sustained campaign since January 2026, using fake event invitations to trick targets into installing a backdoor on Windows computers. The operation has affected more than 100 organizations, primarily in the U.S. and U.K., with victims tied to Ukraine. At least one infection has been confirmed, though the full extent of breaches and data exfiltration remains unverified.

The Hacker Newsabout 5 hours ago1 min read