China-linked hackers exploit Sogou Input flaw to deploy GrayRabbit backdoor

Threat actors tied to a China-aligned espionage group are exploiting CVE-2026-51990, a critical flaw in Tencent's Sogou Input Method for Windows, to deploy the GrayRabbit backdoor. The attack chain is active and targets specific users, though the full scope and victim profile remain unclear. This highlights the risk of supply-chain and software vulnerabilities in widely used Chinese applications.