Kothamine malware uses Tailscale’s tailcat to evade network detection
Malwarebytes details Kothamine, a Windows RAT spread via npm that tunnels commands through Tailscale tailcat.
Malwarebytes Labs documented Kothamine Agent, an undocumented Windows remote-access trojan written in C and C++ with more than 30 commands, including file and command control plus browser-data theft and camera and microphone recording in some builds. Recent samples inject a DLL into explorer.exe, add Microsoft Defender exclusions, persist with a logon scheduled task, and receive commands through Tailscale's open-source tailcat tool, leaving no ordinary command-and-control domain. It has been linked to malicious npm packages, including dotnet-runtime-base, and VirusTotal uploads and GitHub activity suggest activity since at least July 2026; earlier builds used the Tailscale VPN directly.
- Kothamine is a Windows RAT with more than 30 operator commands.
- Malicious npm packages, including dotnet-runtime-base, have distributed it.
- Recent builds tunnel command-and-control through Tailscale tailcat.
- Some versions steal browser data and capture camera and microphone.
- Samples exclude themselves from Defender and persist via a scheduled task.
- ATT&CK
- T1055.001 Dynamic-link Library InjectionT1053.005 Scheduled TaskT1562.001 Disable or Modify ToolsT1195.001 Compromise Software Dependencies and Development ToolsT1572 Protocol Tunneling
- Vendors
- Tailscale
- Malware
- KothamineKothamine Agent
- Organizations
- GitHubMalwarebytes
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| sha256 | 74eca3973ad72a6ddc9397aff8250d9ee287211fc9a055d5ee290d01cf76a70c | ade1eb15d905a6ee0 : Kothamine Injector analyzed in the blog 74eca3973ad72a6ddc9397aff8250d9ee287211fc9a055d5ee290d01cf76a70c : Kothamine Agent analyzed in the blog URLs https://github[ |
| sha256 | ec4219a7ecf132c29080fbb20e4ab410c57faa85aeed7acade1eb15d905a6ee0 | clipboard contents Indicators of compromise SHA-256 hashes ec4219a7ecf132c29080fbb20e4ab410c57faa85aeed7acade1eb15d905a6ee0 : Kothamine Injector analyzed in the blog 74eca3973ad72a6dd |
From the original article
9 min read at malwarebytes.com
Kothamine uses a legitimate Tailscale tool to receive attackers’ commands through an encrypted connection with no malicious domain to block.
By @malwarebytes · malwarebytes.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.