Beijing, February 19, 2025 –Chinese hackers weaponized an EA app to launch stealth attacks, using Windows MAVInject.exe to evade antivirus detection. ESET disputes claims of a bypass.
In a chilling escalation of cyber warfare, Chinese state-backed hacking group Mustang Panda has been caught hijacking a legitimate Electronic Arts (EA) application to deploy a stealthy backdoor. The attack exploits MAVInject.exe, a built-in Windows tool, to inject malware undetected—specifically targeting ESET antivirus users.
Between 2015 and 2019, Mustang Panda secretly embedded its TONESHELL malware inside OriginLegacyCLI.exe, an EA application. Once installed, the malware bypassed antivirus defenses, establishing a covert channel to a China-based command-and-control (C2) server.
Nathaniel Morales, a cybersecurity expert at Trend Micro warned:
This is one of the most sophisticated evasion techniques we’ve seen. By leveraging legitimate software, Mustang Panda can infiltrate systems without raising suspicion.
The campaign appears to have targeted Thailand-based organizations, likely through spear-phishing emails. The malware then activated only when it detected ESET security software, injecting itself using MAVInject.exe to evade detection.
Mike Herrington, FBI Special Agent, sounded the alarm:
This attack highlights a terrifying reality, trusted software is no longer safe. Cybercriminals are adapting faster than ever.
Hackers exploited trusted apps to bypass security, what else could be tracking you unseen? Protect your online activity from stealth threats with ExpressVPN.
Other News At VPNRanks
Hey, wait!
Stay informed on the latest privacy updates, cybersecurity insights, and internet freedom news by following VPNRanks news daily! As your primary resource for critical updates in online security, we ensure you’re always in the know. Make VPNRanks your go-to guide for safeguarding your digital life.
