The Chinese espionage threat group Mustang Panda has updated its CoolClient backdoor to a new variant that can steal login data from browsers and monitor the clipboard.

Chinese Mustang Panda hackers deploy infostealers via CoolClient backdoor

The Chinese espionage threat group Mustang Panda has updated its CoolClient backdoor to a new variant that can steal login data from browsers and monitor the clipboard.

The Chinese espionage threat group Mustang Panda has updated its CoolClient backdoor to a new variant that can steal login data from browsers and monitor the clipboard. [...]

The Chinese espionage threat group Mustang Panda has updated its CoolClient backdoor to a new variant that can steal login data from browsers and monitor the clipboard.

HoneyMyte upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making detection hard.

Our experts discovered a new CoolClient backdoor variant with a kernel-mode rootkit driver that hides malicious processes, files, and network connections from security tools and threat analysts.

HoneyMyte deploys an updated CoolClient backdoor with a signed Windows rootkit that hides malicious processes, files, registry objects, and C2 data.

HoneyMyte, the China-aligned espionage group also tracked as Mustang Panda, has upgraded its CoolClient backdoor with a signed Windows kernel-mode rootkit.

Nova versão do programa espião CoolClient utiliza componente com assinatura digital para esconder arquivos e roubar dados sem ser detectado por antivírus

HoneyMyte upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making detection hard.

HoneyMyte upgraded CoolClient with a signed kernel driver that hides processes, files and network activity, making detection hard.

Read more

At a Glance Actor or Group: HoneyMyte (also known as Mustang Panda) Activity Type: Cyber-espionage and rootkit deployment Targets or Victims: Government entities and organizations in Asia and Russia Scale: Multiple intrusions across Myanmar, Mongolia, Pakistan, and Russia Jurisdiction Status: Unindicted suspected state-sponsored threat group Source: Kaspersky Labs, with previous tracking by Sophos and Trend Micro TL;DR Security researchers discovered an updated variant of the HoneyMyte CoolClient…

Uma versão atualizada do programa espião CoolClient está a ser utilizada em ataques coordenados contra entidades governamentais no Paquistão, Mongólia, Mianmar e Rússia. De acordo com informações avançadas pelo The Hacker News, a nova variante da ameaça é operada pelo grupo cibercriminoso HoneyMyte,

Cryptika (relayant Cyber Security News / Securelist), publié le 17 août 2026. Les chercheurs de Securelist ont identifié cette nouvelle variante lors d'investigations menées fin 2025 et en 2026. Le groupe HoneyMyte (acteur de cyberespionnage) a mis à jour son implant CoolClient avec un composant rootkit en mode noyau.