Kothamine malware uses Tailscale’s tailcat to evade network detection
September 25, 2026 · Malwarebytes · Severity: HIGH
Malwarebytes discovered a new remote-access Trojan called Kothamine Agent that uses Tailscale's tailcat tool for encrypted command-and-control, making it harder to detect. It is linked to malicious npm packages and can steal browser data and record through the camera and microphone. 📌 **Analyst Note:** The use of legitimate tools like tailcat for C2 highlights the challenge of distinguishing malicious traffic from benign, requiring defenders to monitor for unusual usage patterns of such tools.
We discovered an undocumented remote-access Trojan (RAT) called Kothamine Agent. It supports more than 30 commands and it gives attackers control of an infected Windows computer: they can run commands, read and change files, and add new capabilities. Some versions can also steal browser data and record through the camera and microphone.
We found Kothamine linked to malicious npm packages, which could put users and developers who install those packages at risk. In recent versions, the malware uses tailcat, an open-source tool from Tailscale, to receive commands over an encrypted connection. That makes its communications harder to inspect and gives defenders no conventional command-and-control (C2) domain to block.
Based on VirusTotal uploads and GitHub commits, Kothamine appears to have been in development or distribution since at least July. Earlier versions used the Tailscale VPN instead of tailcat. Depending on the build, the malware includes the networking tools or downloads them from sources including GitHub.
How to stay safe
Before installing an unfamiliar npm package, check its repository, maintainers, dependencies, and recent releases. Search for reports of malicious activity, and favor packages with an established history and regular maintenance.
- Check the name carefully. Make sure you aren’t downloading a fake package with a similar name.
- Check the developer or organization and make sure the publisher appears legitimate. Check, for example, if it has a website or a GitHub repository.
- Read some reviews, issues and reports. Search for the package name on Google and check for reports of detected potential malware.
- Look at how popular it is. A package with many downloads and users is generally easier to verify than a brand-new package with almost no history.
Technical analysis
Kothamine and the malicious npm packages
Kothamine is written in C and C++. In the majority of the samples we analyzed, it consists of an injector and a DLL containing the agent. The agent supports more than 30 commands, allowing the operator to control the infected system and load additional DLLs to extend its capabilities.
Kothamine Agent has undergone some changes over time. Earlier versions we found on VirusTotal used the Tailscale VPN rather than tailcat, and the strings were not encrypted. Some features, including a User Account Control (UAC) bypass and stealer commands, were detected only in certain builds.
In some versions, Kothamine downloaded Tailscale files from the official Tailscale website or a GitHub repository instead of including them in the agent.
The same GitHub repository is cited in an advisory about a malicious npm package named dotnet-runtime-base. The package download npm-sc-legit.exe from that repository. At the time of writing, two other packages published by the same developer had been removed.
The authors behind these campaigns made a mistake and published instructions for compiling kothamine-stub-cpp in one of the packages. The guide also discusses loading .NET assemblies, which we did not observe in the samples we analyzed.
The npm-sc-legit.exe executable is a compiled version of Kothamine that also contains commands for stealing data. We did not find a panel or builder for Kothamine, but the features present across different builds suggest that operators can enable particular functions and commands as needed.
