September 26, 2026
- Kothamine Agent, a previously undocumented Windows RAT written in C/C++, uses Tailscale's tailcat to receive commands over an encrypted tunnel — leaving defenders no conventional C2 domain to block. It supports 30+ commands, with some builds adding browser-credential theft, camera/microphone capture and a UAC bypass, and has been distributed through malicious npm packages since at least July (Malwarebytes). · Threat Intelligence