MalwarePublished 27 Jan 2026Updated 26 Feb 2026

CoolClient backdoor updated, new data stealing tools used

Source AlienVault OTX General

Description

The HoneyMyte APT group has enhanced its toolset with an updated CoolClient backdoor and new data stealing capabilities. The group targeted government entities in Asia and Europe, particularly Southeast Asia. CoolClient now features clipboard monitoring, HTTP proxy credential sniffing, and plugin support for extended functionality. HoneyMyte also deployed browser login data stealers and document theft scripts. The campaign's focus has shifted towards active surveillance, including keylogging, clipboard data collection, and proxy credential harvesting. Organizations are advised to remain vigilant against HoneyMyte's evolving toolkit, which includes CoolClient, PlugX, ToneShell, Qreverse, and LuminousMoth malware families.

Impact

European organizations, especially government agencies and entities involved in sensitive operations, face significant risks from this threat. The CoolClient backdoor’s capabilities enable attackers to exfiltrate confidential information such as login credentials, clipboard contents, and sensitive documents, potentially leading to espionage, data breaches, and loss of intellectual property. The use of proxy credential sniffing can allow attackers to pivot within networks, increasing lateral movement and persistence. Active surveillance tools like keyloggers and browser stealers can compromise user privacy and security, undermining trust in government digital services. The stealthy nature of the malware and its modular design increase the likelihood of prolonged undetected presence, exacerbating damage. Given the targeting of government entities, the threat could impact national security, diplomatic relations, and critical infrastructure protection within Europe. The medium severity suggests a moderate but targeted impact, with potential for escalation if combined with other attack vectors or exploited vulnerabilities.

Defensive guidance

To mitigate this threat, European organizations should implement targeted detection mechanisms for CoolClient and associated malware families by leveraging the provided indicators of compromise (hashes, IPs, domains). Network monitoring should focus on unusual proxy authentication traffic and outbound connections to suspicious domains or IP addresses. Endpoint detection and response (EDR) tools must be configured to identify clipboard monitoring, keylogging activities, and unauthorized plugin executions. Multi-factor authentication (MFA) should be enforced for all remote and proxy access to reduce credential theft impact. Regular audits of proxy and network credentials, combined with immediate revocation of compromised credentials, are essential. Organizations should conduct threat hunting exercises focusing on HoneyMyte’s TTPs (techniques, tactics, and procedures) and maintain updated threat intelligence feeds. Employee awareness training on spear-phishing and social engineering, common initial infection vectors for APTs, will help reduce infection likelihood. Incident response plans must include procedures for rapid containment and forensic analysis of CoolClient infections. Collaboration with national cybersecurity centers and sharing of threat intelligence can enhance collective defense.

Indicators of compromise

Domains 3

popnike-share.com
account.hamsterxnxx.com
japan.lenovoappstore.com

URLs 1

http://45.144.165.65/BUIEFuiHFUEIuioKLWENFUoi878UIESf/MUEWGHui897hjkhsjdkHfjegfdh/67jksaebyut8seuhfjgfdgdfhet4SEDGF/Tools/getlogindataedge.exe

IP addresses 2

113.23.212.15
45.144.165.65

Hashes 15

1a5a9c013ce1b65abc75d809a25d36a7
1a61564841bbbb8e7774cbbeb3c68d5d
1bc5329969e6bf8ef2e9e49aab003f0b
6b7300a8b3f4aac40eeecfd7bc47ee7c
7aa53ba3e3f8b0453ffcfba06347ab34
838b591722512368f81298c313e37412
a1cd59f769e9e5f6a040429847ca6eae
a4d7147f0b1ca737bfc133349841aaba
aeb25c9a286ee4c25ca55b72a42efa2c
c19bd9e6f649df1df385deef94e0e8c4

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 27 Jan 2026, 16:35 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details