Kothamine malware uses Tailscale's tailcat to evade network detection

An undocumented remote-access Trojan named Kothamine Agent has been discovered with support for over 30 commands, enabling attackers to control infected Windows systems through command execution, file manipulation, and capability extension. Some variants include browser data theft and camera/microphone recording functionality. The malware has been distributed through malicious npm packages and utilizes tailcat, an open-source Tailscale tool, to establish encrypted command-and-control communications that evade conventional network inspection and blocking. Earlier versions employed Tailscale VPN before transitioning to tailcat. Active since July based on VirusTotal and GitHub evidence, Kothamine features a plugin system for loading additional DLLs, UAC bypass capabilities in certain builds, and employs AES-GCM encryption for C2 communications. The malware achieves persistence through scheduled tasks and adds Windows Defender exclusions during installation.

• Nightmare Eclipse Drops Windows Zero-Day Exploit ‘SignDrop’HighExploit2026-11-13
• VU#644655: TightVNC and UltraVNC Viewer contains a heap-based buffer overflowHighVulnerability2026-11-13
• Never be afraid to ask questionsAnalysis2026-11-12
• T-SQL Being Abused to Deliver Malware on Compromised MS SQL ServersMalware2026-11-12
• Microsoft Patch Tuesday for November 2026 — Snort rules and prominent vulnerabilitiesMediumVulnerability2026-11-11