Kothamine Malware Exploits Tailcat for Evasive Remote Access

• •Kothamine is a RAT using tailcat for encrypted C2 communications.
• •The malware is linked to malicious npm packages, notably dotnet-runtime-base.
• •Users should rigorously vet npm packages to avoid infection.

Kothamine is an undocumented remote-access Trojan (RAT) discovered in malicious npm packages. It employs Tailscale's tailcat to create encrypted command-and-control channels, evading traditional network detection methods. The malware allows attackers to control infected Windows systems, execute commands, and steal data. Researchers linked Kothamine to the npm package dotnet-runtime-base, revealing a multi-stage execution process that includes an injector targeting explorer.exe. The malware's architecture supports modular plugins for additional capabilities. Users are advised to thoroughly vet npm packages before installation and monitor for unauthorized use of networking tools. The malware has been active since at least July 2026, with various versions exhibiting different capabilities. Current recommendations include isolating affected systems and performing memory forensics to identify the Kothamine Agent DLLs.