What is DLL hijacking, and why your new AI plugin might be the easiest way in
DLL hijacking is a decades-old Windows vulnerability class (Mitre Att@ck T1574) getting new life from AI plugins bolted onto legacy desktop apps. Attackers plant a malicious DLL where a vulnerable app will load it instead of the real one, inheriting that app's privileges. To detect it, watch for DLLs loaded by name from writable folders. To prevent it, you have to fix the app's load-order logic or blocking untrusted DLLs at the endpoint.