Researchers reported a real intrusion where a China-linked group used a crafted link to exploit Sogou Input Method on Windows and install the GRAYRABBIT backdoor. Victims were lured into opening a special link (potentially via email or chat), which redirected Sogou’s built-in browser to an attacker-controlled page that executed code and installed a remote-access backdoor.
A China-linked group tracked as UNC3569 used a specially crafted link to trigger components of Sogou Input Method on Windows. Instead of behaving like a normal link, it launched Sogou's built-in browser and redirected it to an attacker-controlled page. That page carried an exploit for CVE-2021-38003, which let the attacker run code with the same privileges as the logged-in user. From there, a downloader pulled in a legitimate copy of 7-Zip alongside a malicious DLL (saved as 7z.dll) and an encrypted payload, all written to C:\Users\Public\Documents. The end result was installation of the GRAYRABBIT backdoor, which communicated with mail.uaiubifas[.]top over port 443 using RC4-scrambled plain TCP rather than standard TLS.
The chain relied on a single click to set everything in motion. Because the link used a custom handler rather than a normal https address, it could launch an application directly and hand off control to an embedded browser most users would not expect to interact with. Tencent described the chain as relatively complex, noting that an attacker would still need some social engineering to get a user to actively authorize a browser pop-up prompt. The embedded browser engine also remained on an older Chromium 80 build with key protections disabled, which widened the exposure even after the underlying link-handling issue was addressed.
Employees, especially those using Sogou Input Method on Windows, should treat unexpected links delivered by email or chat as suspicious, particularly if they trigger an application launch or a system prompt. Any request to "authorize" a browser pop-up should be verified through a trusted channel before approval. IT and security teams should monitor for unusual file drops to public folders, unexpected encrypted payloads, and non-TLS traffic on common secure ports like 443, since these can indicate a backdoor has already been installed. Building this kind of awareness across government, education, technology, and finance teams can help catch a one-click exploit chain before it completes.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A crafted link triggered Sogou Input Method components and opened an attacker-controlled page inside Sogou's embedded old Chromium browser, which used CVE-2021-38003 to execute code with the logged-in user's privileges.
The exploit chain downloaded a legitimate copy of 7-Zip, a malicious DLL saved as 7z.dll, and an encrypted payload into C:\Users\Public\Documents, ultimately installing the GRAYRABBIT backdoor.
It reached out to mail.uaiubifas[.]top over port 443 using plain TCP scrambled with RC4 rather than standard TLS, which is unusual traffic for that port.
According to the reporting, clicking the link was enough to start the chain, though Tencent noted the attacker would still need social engineering to get the user to authorize a browser pop-up prompt.
Clicking the link was all it took: one Sogou shortcut, and the GRAYRABBIT backdoor was on their PC. UNC3569 used that crafted 'sgbiz:' link to launch Sogou Input Method’s built-in Chromium browser, hit an exploit page for CVE-2021-38003, and silently drop the GRAYRABBIT backdoor. Behind that one click, the exploit pulled a legit 7-Zip plus a fake 7z.dll and an encrypted payload into C:\Users\Public\Documents, then GRAYRABBIT started talking to mail.uaiubifas.top on port 443 using weird non‑TLS traffic. Your move: if a link tries to open Sogou or any app via a custom type like 'sgbiz:' and pops up an authorization box you weren’t expecting, stop and report it to security, don’t click Open.
Researchers described an active phishing operation using real DocuSign notifications to trick employees into opening a fake “remittance-advice” document and clicking a hidden malicious link. The attack routes victims through legitimate Microsoft/Google pages before landing on an…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers say a Chinese-speaking cybercrime group compromised Brazilian government and education websites and used them as “trusted” entry points to quietly redirect visitors to attacker-run phishing pages. The fake pages impersonated well-known app stores (Google Play, Microsoft Store, Amazon)…
Google tracked three suspected Russia-linked groups running targeted phishing that abuses real login and authentication features (app passwords, OAuth, and device codes) to get into accounts. The lures often look like legitimate conference or diplomatic invitations, and some campaigns spoof…
Google says three suspected Russian cyber-espionage groups are running highly targeted phishing campaigns against people in government, academia, defense, and think tanks in the US and Europe. A key theme is abusing legitimate Google/Microsoft OAuth login flows so the outreach looks real, tricking…
Proofpoint reports multiple China-aligned espionage groups used a chained set of browser/Windows zero-days (“BlueMoon”) and delivered it through phishing emails. Victims who clicked a phishing link could end up with a malicious browser extension disguised as Google Gemini, letting attackers watch…
