---
title: "Discussion on \"HoneyMyte Takes CoolClient Into the Kernel: When a Rootkit Changes What Windows Lets You See\" | Hashnode"
description: "Discussion on \"HoneyMyte Takes CoolClient Into the Kernel: When a Rootkit Changes What Windows Lets You See\". Summary\nCoolClient was already a fully capable espionage backdoor: keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and a plugin-based extension architecture"
url: "https://hashnode.com/posts/honeymyte-coolclient-kernel-rootkit-en/6a8d38b7d666a6491bd810eb"
---

[Feed](https://hashnode.com/feed) /

Discussion

# [HoneyMyte Takes CoolClient Into the Kernel: When a Rootkit Changes What Windows Lets You See](https://blog.fiscybersec.com/honeymyte-coolclient-kernel-rootkit-en?utm_source=hashnode&utm_medium=feed)

Summary CoolClient was already a fully capable espionage backdoor: keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and a plugin-based extension architecture

Aug 25 · 22 min read · blog.fiscybersec.com  
Read the article

-   [#honeymyte](https://hashnode.com/tag/honeymyte)
-   [#mustang-panda](https://hashnode.com/tag/mustang-panda)
-   [#coolclient](https://hashnode.com/tag/coolclient)
-   [#kernel-rootkit](https://hashnode.com/tag/kernel-rootkit)
-   [#msagent-sys](https://hashnode.com/tag/msagent-sys)
-   [#dll-sideloading](https://hashnode.com/tag/dll-sideloading)
-   [#plugx](https://hashnode.com/tag/plugx)
-   [#ioctl](https://hashnode.com/tag/ioctl)
-   [#nsiproxy](https://hashnode.com/tag/nsiproxy)
-   [#driver-signing](https://hashnode.com/tag/driver-signing)
-   [#apt](https://hashnode.com/tag/apt)
-   [#threat-intelligence](https://hashnode.com/tag/threat-intelligence)

## Written by

[Vũ Nhật Lâm](https://hashnode.com/@kami61)

@kami61

  
[View profile](https://hashnode.com/@kami61)

## Responses

Markdown supported · ⌘↵ to post

No responses yet.