Executive Summary
Proofpoint researchers identified a new modular remote access trojan (RAT) and command and control (C2) framework named PackClient, which is being actively marketed on Chinese-language Telegram channels. The framework supports extensive surveillance capabilities, including keylogging, screen capture, and webcam access, and is utilized by the Chinese-speaking threat actor TA4922.
In campaigns observed between May and July 2026, TA4922 targeted organizations in mainland China and India using tax-themed lures impersonating government agencies. The attack chain evolved from direct executable delivery to more sophisticated methods involving DLL sideloading and Donut Loader. The business impact includes high risks of data theft, unauthorized surveillance, and the potential for long-term persistence via its modular plugin system.
The adoption of PackClient by TA4922 indicates an expansion of their toolkit, drawing from the broader Chinese cybercrime ecosystem. Given its availability on Telegram, it is highly likely that other threat actors will adopt this framework, increasing the threat to organizations with operations in Asia and potentially globally.