Kothamine gives a Windows intruder an encrypted route back into the computer through a legitimate networking tool. In research published September 25, Malwarebytes identified the remote-access Trojan using tailcat, an open-source Tailscale project, for its command channel. The important distinction is what the tunnel carries: encryption protects a connection even when the commands inside it are hostile. [1]
The connection starts inside the infected computer
Researchers linked Kothamine to malicious npm packages and found development or distribution traces dating to July. One package even exposed compilation instructions. In analyzed samples, an injector places the agent DLL inside explorer.exe; an Edge-like filename and a logon task help it persist.
The recent build starts tailcat and connects to 127.0.0.1:18080, which forwards to the operator’s port 4444. The research console below shows that handoff. Capabilities vary by build: remote commands and file access are central; browser theft and camera or microphone recording appear in some versions. The report does not establish a victim count.
127.0.0.1 is the computer’s loopback address. Seeing it in a connection log does not mean the conversation ends on that computer. Here, the local listener acts as an entrance to the remote channel. For an investigator, the useful question becomes which process opened that listener and which program is connecting to it.
A secure tunnel does not authorize the sender
Tailscale’s documentation describes tailcat as a tool that reuses its networking components without the normal Tailscale control plane. It can connect two machines with WireGuard encryption, negotiate a direct path where possible, and use a relay when necessary. It does not require a Tailscale account or administrator rights merely to run. [2]
That design explains why a familiar tool name is a poor verdict on its own. A legitimate administrator and an intruder can both need a network path. The security decision belongs to the application using that path: who started it, who controls the other end, and what the receiving process is allowed to do. The findings concern abuse of the tool; they do not establish a compromise of Tailscale’s service.
The project’s own security notes call its wrapper experimental and explain that it originally assumed one person controlled both ends. They caution against accepting addresses or exposing powerful services to untrusted parties. That is a trust boundary, not a promise that encryption makes an unfamiliar connection harmless. [3]
Contain the program, then check what it could reach
Tailcat installed for a known task is not proof of Kothamine. An unexplained tunnel launched after an unfamiliar package ran deserves investigation. Keep the package name, version, installation time and security alerts; do not rerun the suspected package to reproduce the problem. On a work computer, disconnect it from the network and give that evidence to the security team.
If an untrusted executable ran on your own Windows PC, removing the visible file may leave a loader, scheduled task or security exclusion behind. You can install and update Gridinsoft Anti-Malware, run a Full Scan, review detections, apply cleanup, restart and check again. Manual hunting is a fallback if symptoms remain, not an extra mandatory sequence.
After uninstalling the suspicious app or deleting the visible threat, use Gridinsoft Anti-Malware to check hidden files, startup entries, scheduled tasks, bundled apps, browser changes, and other persistence points that can restore malware.
Check the PC for malwareIf browser data or developer secrets may have been exposed, use a separate trusted device to revoke relevant sessions and rotate credentials. A clean scan cannot undo data theft. The same distinction between removing a payload and closing continued access matters in the Storm-2570 remote-access investigation.
Kothamine’s lesson is to assess the program and its access, not just the reputation of the software carrying its traffic.
References
- Gabriele Orini. “Kothamine malware uses Tailscale’s tailcat to evade network detection.” Malwarebytes, September 25, 2026. Research report.
- Tailscale. “Tailcat — README.” GitHub, accessed September 26, 2026. Project documentation.
- Tailscale. “Security — Threat model.” GitHub, accessed September 26, 2026. Security notes.
