Threat actors are installing legitimate DB client tools like DBeaver and Navicat on compromised systems to covertly steal sensitive database information.