A newly documented Windows remote-access Trojan dubbed Kothamine Agent is turning legitimate developer tooling against defenders, abusing Tailscale’s tailcat utility and malicious npm packages to hide its command-and-control traffic and gain deep control over compromised systems.
Kothamine is written in C and C++ and typically deploys as an injector executable paired with a DLL agent loaded into a benign process such as explorer.exe. Once resident, the agent exposes more than 30 commands that let attackers run arbitrary code, read and modify files, and extend functionality by loading additional DLLs, with some builds also capable of stealing browser data and recording from the victim’s camera and microphone. The injector component adds Windows Defender exclusions via PowerShell, drops its payloads into the user’s roaming profile under names mimicking Microsoft Edge update binaries, and establishes persistence with a scheduled task that relaunches the injector at logon, making the malware difficult to dislodge using basic endpoint controls.
The campaign appears to be tied to a software supply chain attack involving malicious npm packages that pull down and execute Kothamine payloads. Security researchers have flagged the dotnet-runtime-base npm package as malicious and noted that its contents were removed from the official registry after discovery, warning that any system where the package was installed or run should be treated as fully compromised[10][12][15]. One advisory lists affected versions and describes how the package downloads an executable named npm-sc-legit.exe, which is a compiled Kothamine build that includes data-stealing commands alongside the core RAT capabilities[10][12][15]. At least two other npm packages attributed to the same publisher have since been taken down, suggesting broader abuse of the ecosystem, though no public CVE has yet been assigned and attribution of the threat actors behind the campaign remains unclear.
What distinguishes recent Kothamine variants is not unusually advanced obfuscation but their use of tailcat as a covert communications channel. Tailcat is described by Tailscale as a netcat-style CLI that runs over its WireGuard-encrypted data plane, using components such as magicsock and DERP relays to connect machines across different networks without the usual Tailscale account, tailnet, or IP address model[2][8][14]. Tailscale’s documentation emphasizes that tailcat connections are established simply by sharing a generated “tailcat address,” with no login flow or control-plane governance, which makes the tool attractive for short-lived, peer-to-peer links and, in this case, for malware operators seeking to avoid conventional C2 infrastructure[8][14]. In recent Kothamine builds, the agent extracts a portable copy of tailcat.exe from its resources and drops it under a Tailscale-themed directory in the user’s roaming profile before spawning it with parameters that set up a forward channel, effectively tunneling attacker commands over an encrypted link that blends in with legitimate remote operations.
Tailcat itself is an open-source project with active security hardening, and its maintainers have documented several past issues—such as early versions allowing file overwrites in certain receive modes and bugs around how untrusted tailcat addresses were validated—and corresponding fixes in a dedicated security overview[1][4]. Those issues were largely “attack-yourself” scenarios, where misuse of untrusted addresses or incorrect configuration could lead to unintended behavior, rather than remote exploitation by third parties[1][4]. Nevertheless, the same characteristics that make tailcat convenient for quickly linking machines—no accounts, minimal metadata, and end-to-end encrypted tunnels—also mean that when it is embedded inside malware like Kothamine, defenders lose obvious indicators such as suspicious domains or static IP ranges to block, forcing them to rely more heavily on behavioral detection, process lineage analysis, and host-based telemetry rather than traditional network filtering.
For organizations and developers, the immediate risk lies in compromised development environments and the downstream impact of a poisoned supply chain. Teams should review build and CI pipelines for any use of dotnet-runtime-base or similarly named packages, remove them where found, and re-image systems that may have executed malicious installers, following advisory guidance that treats affected machines as fully compromised[10][12][15]. Beyond this specific campaign, developers can reduce exposure by scrutinizing unfamiliar npm packages before installation, checking the publisher’s reputation and project history, validating that repositories and websites are legitimate, and searching for prior reports of malicious behavior or typosquatting. On the defensive side, monitoring for unusual PowerShell activity that adds broad Windows Defender exclusions, unexpected scheduled tasks pointing to user roaming directories, and child processes launching binaries named like Tailscale or tailcat from nonstandard paths can provide valuable signals that tools designed for secure connectivity are being repurposed as stealthy C2 channels.
References
- Security – Overview · tailscale/tailcat – GitHub
- tailscale/tailcat – GitHub – DataFortress.cloud
- Service Handlers: SFTP, Files, and Exec | tailscale/tailcat | DeepWiki
- tailcat – Tailscale
- dotnet-runtime-base | Snyk
- Snyk Vulnerability Database | Snyk
- README.md – tailscale/tailcat
- GHSA-9gr8-wg29-9wvv malware advisory: critical-sev…
