MALWAREBYTES researchers have identified an undocumented remote-access Trojan (RAT) called Kothamine Agent, which gives attackers control of infected Windows computers. It supports more than 30 commands for running shell commands, managing processes and files, and loading additional DLL-based features. Some builds can also steal browser and gaming-related data, access the clipboard, take screenshots, record through the camera and microphone, and attempt a User Account Control (UAC) bypass.
The researchers linked Kothamine to malicious npm packages, putting developers and users who install them at risk. Evidence from VirusTotal uploads and GitHub commits suggests it has been developed or distributed since at least July 2026.
Recent versions use tailcat, an open-source Tailscale tool, to create an encrypted command-and-control channel. This can make traffic harder to inspect and avoids a conventional C2 domain for defenders to block. The malware extracts `tailcat.exe`, forwards a local port to an operator-controlled node and communicates through the local connection using AES-GCM encryption. Earlier samples instead used the Tailscale VPN.
Kothamine’s injector adds Windows Defender exclusions, copies itself as `MicrosoftEdgeUpdateCore.exe`, injects its DLL into `explorer.exe` and creates a scheduled task for persistence. Malwarebytes also found versions that download Tailscale components from GitHub or the official Tailscale website. Users should scrutinise unfamiliar npm packages, checking their names, publishers, repositories, dependencies, release history and reports of malicious activity. The researchers published hashes for analysed samples and identified `https://github[.]com/cphc811-ui/` as an associated download repository.