Loading malware…
HoneyMyte is a malware/toolset associated in reporting with Chinese-speaking espionage activity. Kaspersky noted that HoneyMyte has used the DLL side-loading “triad” technique—legitimate executable, malicious side-loaded DLL, and encoded payload—a tradecraft pattern also seen in other China-linked operations. One of the more distinctive HoneyMyte components is a cookie stealer designed to harvest authentication cookies for web-based productivity and email services across multiple browsers, enabling later remote access to victims’ email accounts via stolen session cookies. Kaspersky reported a new HoneyMyte cookie-stealer variant observed in Vietnam starting in June 2023 that added support for the Vietnamese Coc Coc browser. Related HoneyMyte tools were previously reported by Kaspersky in August 2019 and June 2021. The provided content does not include specific file hashes or domains directly attributed to HoneyMyte.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware set that includes cookie-stealing components to enable remote access to webmail/productivity accounts.
Mentioned as another example of a Chinese-speaking nexus toolchain using a DLL sideloading “triad” technique; no further technical details provided in this content.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.