Gen Threat Labs discovered CVE-2026-51990 while investigating a live intrusion by UNC3569, a Chinese hacker-for-hire group Google Threat Intelligence has tracked since 2021. The initial access traced back unexpectedly to Sogou Input Method, one of the most widely used Chinese-language input method editors with hundreds of millions of Windows installations. The vulnerability chains three weaknesses: unvalidated command-line argument injection into the sgbiz: custom protocol handler, unrestricted URL navigation within that handler, and an outdated and unsandboxed Chromium browser engine embedded in the application. When a target clicks a crafted sgbiz: link, Windows launches Sogou's biz_helper.exe protocol handler, which passes the attacker's command-line arguments to the embedded Chromium instance without validation. That Chromium instance, running without a sandbox, executes attacker-controlled code. The exploit drops a malicious 7z.dll loader that decrypts and loads GrayRabbit (core.dll), UNC3569's first-stage backdoor in use since 2021. GrayRabbit provides a remote shell, file transfer in both directions, dynamic plugin loading from the attacker's C2, and communicates via RC4-encrypted TCP on port 443. Gen reported the vulnerability to Tencent on April 9. Tencent patched it in version 16.3.0.3498 via automatic update. The patch added URL validation in the protocol handler but did not update the Chromium configuration. Gen confirmed as of September 10 that the Chromium version and configuration remain unchanged, meaning a different exploitation path through the same underlying component cannot be ruled out. IoCs: SHA-256 29c7ee41d0cc9e07d981e451df56d0c3d37c41ac4ec10c7b516cc033ee397a63 (loader DLL written as 7z.dll), SHA-256 749160a2f20f82744026719cf72e483595c6aad718efa74d675a98662e02422e (encrypted payload named p), SHA-256 d7a3c7eb94edc0e020f74c678743d71d61e944634aade4a67a96c3589e828b3a (GrayRabbit backdoor, internal name core.dll).

Revolut confirmed on September 12 that it disclosed sensitive customer data to an unauthorized third party after receiving fraudulent information requests sent from an email account operating within a legitimate government agency's domain infrastructure. Revolut describes it as a sophisticated external impersonation scam in which the attacker used a real government agency email address. The requests passed Revolut's standard domain authentication checks because the domain genuinely belonged to a government agency. The data Revolut handed over is precisely what financial institutions collect for Know Your Customer compliance: full name, date of birth, postal address, email address, phone number, copies of passport or driver's license, facial verification selfies taken during onboarding, account statements including the IBAN, account opening date, withdrawal records, and the complete transaction history including Bitcoin wallet reference numbers. Revolut says a limited number of customers are affected, has not named the specific government agency or markets involved, and confirms customer funds and passwords were not compromised. The customer notification was first flagged publicly by crypto investigator ZachXBT on September 12. The FBI published a warning in November 2024 that compromised government email accounts were being purchased and used specifically for fraudulent emergency data requests of this type.

Microsoft disclosed details of two concurrent abuse campaigns on September 13. The first campaign used third-party bulk email delivery infrastructure: the same services organizations use for legitimate marketing, to send CEO-impersonation emails to accounts payable departments, targeting them for ACH transfer fraud by impersonating the CEO requesting a ServiceNow subscription payment. Routing through legitimate email delivery infrastructure means the sending domain passes SPF, DKIM, and DMARC checks. Microsoft observed over one million such emails sent between August 3 and August 5. The second campaign uses passkey-themed social engineering to hijack Microsoft 365 cloud accounts. The specific technique is blob: URL phishing: the attacker sends a link that generates the phishing page as a blob: URL object rendered entirely in the victim's local browser memory. A blob: URL is a reference to a locally-generated object, not a remote server. It therefore has no static URL a proxy, email filter, or URL reputation service can evaluate; the page does not exist at any network-accessible address. The phishing page presents a passkey authentication prompt, captures the submitted credentials or session token, and hijacks the Microsoft cloud account. Microsoft identified invisible Unicode characters being used in subject lines to bypass phishing keyword filters in the same campaign cluster.