A newly documented Windows remote-access Trojan called Kothamine takes its orders through tailcat, a legitimate open-source tool released by Tailscale, which leaves defenders with no conventional command-and-control domain to block. Researchers at Malwarebytes, who published the analysis, tied the malware to malicious npm packages, putting developers who install them squarely in the blast radius.
Kothamine is not sophisticated in the usual sense. Malwarebytes says its distinctive feature is not complexity or obfuscation but the channel it talks over. Based on VirusTotal uploads and GitHub commits, the researchers assess it has been in development or distribution since at least July.
A back door that arrives through npm
The link to the npm ecosystem runs through a GitHub repository. Some Kothamine builds pulled Tailscale files from that repository, and the same repository is cited in Mondoo's advisory about a malicious npm package named dotnet-runtime-base, which downloads an executable called npm-sc-legit.exe from it. Malwarebytes says that executable is a compiled Kothamine build that also carries data-stealing commands. Two other packages from the same developer had already been removed when the researchers wrote their report.
The operators also made a mistake: one of their packages shipped instructions for compiling the Kothamine stub, which is how the researchers learned more about the project than the samples alone revealed.
Encrypted orders with nothing to block
Tailcat uses Tailscale's data plane (WireGuard, NAT traversal and relay servers) without its control plane, so it needs no account and no device registration. Access depends on holding a tailcat address and the right public keys. Malwarebytes notes this is not fully anonymous, since hosted relays may retain metadata logs.
In recent builds the agent drops tailcat to %APPDATA%\TailscalePortable\tailcat.exe and runs it in forward mode, exposing the operator's node as local port 18080. The malware then connects to that local port, sends an encrypted profile, and waits in a loop for AES-GCM encrypted commands. Earlier versions used the full Tailscale VPN instead, silently installing it and joining the operator's network with an embedded auth key.
On the host, an injector adds Windows Defender exclusions through PowerShell, copies itself to MicrosoftEdgeUpdateCore.exe in the roaming profile, injects the agent DLL into explorer.exe, and registers a logon scheduled task named MicrosoftEdgeUpdateTask for persistence. Some builds bypass User Account Control using fodhelper.exe, a well-worn UAC bypass technique.
Thirty commands and a plugin loader
The analysed build supports 30 commands covering processes, files, directories and shell execution, plus a plugin system that lets the operator push a base64-encoded DLL and run it inside the agent. Other builds add commands to steal browser cookies and Steam and Minecraft files, grab the clipboard, take screenshots, and record through the camera and microphone. Malwarebytes found no panel or builder, but the variation between builds suggests operators switch features on as needed.
Vet the package, then hunt for tailcat
Malwarebytes advises checking an unfamiliar npm package's repository, maintainers, dependencies and release history before installing it, and watching for lookalike names. Defenders can also hunt for tailcat or Tailscale binaries in user profile folders where nobody installed them, the mutex Local\KothamineAgentInstance, and unexpected Defender exclusions for Edge-update-named files. Our earlier story on npm malware that kept downloading after takedown shows why removing the package is not the end of the cleanup.
Indicators published by Malwarebytes:
- SHA-256 (Kothamine Injector): ec4219a7ecf132c29080fbb20e4ab410c57faa85aeed7acade1eb15d905a6ee0
- SHA-256 (Kothamine Agent): 74eca3973ad72a6ddc9397aff8250d9ee287211fc9a055d5ee290d01cf76a70c
- Repository hosting Tailscale components: hxxps://github[.]com/cphc811-ui/
The lesson travels beyond this one Trojan. As legitimate tools strip away accounts and control planes for convenience, the same properties hand attackers a channel that blends into ordinary traffic, and detection has to move from the network edge to what is running on the host.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.