Hackers exploit Tencent app flaw to deploy GrayRabbit malware

Threat actors linked to a China‑aligned espionage group are weaponising a critical flaw (CVE-2026-51990) in Tencent’s Sogou Input Method for Windows to install the GrayRabbit backdoor, exposing millions of users to covert surveillance and data exfiltration.

Technical Anatomy of CVE-2026-51990

The vulnerability resides in the Sogou Input Method, a third‑party keyboard that runs with the same privileges as the logged‑in user. Because input methods intercept keystrokes, any code execution flaw can grant an attacker unrestricted access to typed credentials, documents, and session tokens. The CVE identifier signals a publicly disclosed weakness that attackers can reliably reproduce across vulnerable installations.

Exploiting this flaw does not require social engineering; the malicious payload can be delivered through a compromised update or a malicious installer that masquerades as a legitimate Sogou component. Once the malicious code runs, it can drop the GrayRabbit binary into the system’s executable path, evading many heuristic detections that focus on more common malware families.

From a defensive standpoint, the flaw underscores the risk of trusting auxiliary software that operates at a low level of the operating system. Input method editors (IMEs) are rarely scrutinised by enterprise IT teams, yet they inherit the same trust model as core OS components, making them an attractive pivot point for sophisticated actors.

Operational Use of the GrayRabbit Backdoor

GrayRabbit is a modular backdoor designed to maintain persistence while remaining stealthy. It establishes encrypted C2 channels, allowing the operator to issue commands, exfiltrate files, and capture screenshots without triggering standard alerts. The malware’s architecture mirrors other espionage tools that prioritise low‑noise communication over raw destructive capability.

Because the backdoor is delivered via a trusted input method, it can bypass application whitelisting solutions that rely on known executable hashes. Once installed, GrayRabbit often registers itself as a legitimate Windows service, blending into the host’s process tree and complicating manual investigation. Its ability to hook into the IME also enables keylogging at the point of entry, capturing credentials before they are encrypted by downstream applications.

The operational pattern observed in the wild suggests a “drop‑and‑wait” model: the initial exploit plants the backdoor, and the threat actors monitor the infected host for high‑value activity before initiating data exfiltration. This staged approach reduces the likelihood of early detection and maximises the intelligence yield per compromised system.

Strategic Implications of a China‑aligned espionage group Targeting Consumer Software

By focusing on a widely distributed consumer IME, the actors blur the line between personal and corporate risk. The Sogou Input Method is bundled with many Chinese‑language Windows installations, meaning the attack surface extends beyond niche tech circles into mainstream office environments. This broad reach aligns with state‑sponsored objectives of long‑term intelligence collection.

The choice of a backdoor like GrayRabbit indicates a strategic shift from ransomware or financially motivated malware toward persistent espionage. Data harvested from keylogging and file exfiltration can feed into broader intelligence dossiers, supporting geopolitical objectives rather than immediate monetary gain. The operation also serves as a proof‑of‑concept for future supply‑chain compromises of seemingly innocuous utilities.

For defenders, the incident highlights the necessity of scrutinising third‑party software updates, especially those that integrate deeply with the OS. Traditional perimeter defenses are insufficient when the attack vector originates from a trusted component already present on the endpoint.

What This Actually Means For You

1. Any Windows machine running the Sogou Input Method is potentially vulnerable until a patch is applied.
2. GrayRabbit can capture keystrokes and exfiltrate data without obvious signs, making it a silent data‑theft risk.
3. Standard antivirus signatures may miss the backdoor because it leverages a legitimate process.
4. Enterprise policies that prohibit non‑essential third‑party IMEs can dramatically reduce exposure.
5. Monitoring network traffic for unusual encrypted outbound connections can help spot GrayRabbit C2 activity.

Immediate Action Steps

Verify the version of Sogou Input Method for Windows installed on all endpoints and compare it against the latest release notes from Tencent. If a security update addressing CVE-2026-51990 is available, deploy it immediately across the network.

For systems where the input method is not essential, uninstall it to eliminate the attack surface entirely. Complement this with a full endpoint scan using a tool that can detect anomalous services and unknown network connections, focusing on encrypted outbound traffic patterns typical of GrayRabbit.

Frequently Asked Questions

How does GrayRabbit get installed via the Sogou Input Method?

The exploit leverages CVE-2026-51990 to execute arbitrary code during the input method’s update process, allowing the backdoor to be dropped onto the system without user interaction.

What are the indicators of a GrayRabbit infection?

Typical signs include a new Windows service registered under the Sogou process name, encrypted outbound connections to unknown IPs, and unexplained keylogging activity in system logs.

Has Tencent released a patch for CVE-2026-51990?

The report notes that threat actors are actively exploiting the flaw, implying that a public patch had not been issued at the time of writing.

What Do You Think?

Given the ease with which a trusted input method can become a surveillance conduit, should organisations ban non‑essential third‑party IMEs outright?