COOLCLIENT is a backdoor used by Mustang Panda. An updated variant deploys a signed kernel-mode driver (Msagent.sys) to hide processes and protect files, enhancing stealth. It supports keylogging, clipboard theft, credential harvesting, and plugin-based extensions.