Loading story…
Researchers identified Kothamine Agent, an undocumented C/C++ Windows remote-access Trojan linked to malicious npm packages including dotnet-runtime-base. The RAT persists through a scheduled task, injects its agent DLL into explorer.exe, attempts to add Microsoft Defender exclusions, and gives operators more than 30 commands for system, process, file, and shell control as well as loading of additional DLL plugins.
Recent Kothamine variants use Tailscale's tailcat utility to create encrypted command-and-control channels without a conventional C2 domain, replacing earlier use of the Tailscale VPN and making network detection more difficult. Some builds also incorporate UAC-bypass and surveillance or theft functions, including browser-cookie and clipboard theft, screenshots, camera and microphone capture, and collection of Steam, Minecraft, and Discord-related data.
Pull IOCs and campaign context straight into your stack.
5 events from the most recent confirmed update back to the earliest known activity.
MAL-2026-10217/GHSA-9gr8-wg29-9wvv disclosed that dotnet-runtime-base versions 1.0.4 and 1.0.5 use a Windows-only postinstall script to download and covertly execute npm-sc-legit.exe through PowerShell. The advisory rated the malicious package CVSS 10.0 and advised affected users to treat systems as fully compromised and rotate secrets from a trusted device.
Recent Kothamine variants extract Tailscale's tailcat utility and use it to forward a local listener to an operator-controlled port, avoiding a conventional C2 domain and Tailscale account or device registration. The malware communicates with the local listener over sockets and encrypts C2 messages with AES-GCM.
The malicious npm package dotnet-runtime-base downloaded npm-sc-legit.exe from a GitHub repository; the executable was a compiled Kothamine variant with data-stealing commands. Package authors also exposed build instructions for kothamine-stub-cpp in one malicious package.
Earlier Kothamine builds used the Tailscale VPN for command-and-control functionality, in some cases downloading Tailscale components from official or GitHub-hosted sources.
VirusTotal uploads and GitHub commits indicate that the undocumented C/C++ Kothamine Windows remote-access Trojan had been under development or distribution since at least July.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcemalwarebytes.com
Open sourcemondoo.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers reported that the **MicrosoftSystem64** remote access trojan is being delivered through poisoned npm packages including `js-logger-pack`, expanding from a software supply chain lure into a full second-stage malware deployment aimed at developers. SafeDep first documented the payload and JFrog later independently confirmed the activity, while public reporting and threat-tracking posts linked the campaign to the North Korea-associated **Contagious Interview** / **Famous Chollima** cluster. The malware is described as cross-platform, with persistence mechanisms for **Windows, macOS, and Linux**, and remained active with attacker infrastructure and victim monitoring still online. The RAT steals browser credentials, cryptocurrency wallet data, Telegram Desktop sessions, SSH keys, keystrokes, and screenshots, then uses **private HuggingFace datasets** for payload hosting and data exfiltration. Researchers said this abuse of HuggingFace helps the traffic blend into legitimate HTTPS API activity, making detection more difficult than conventional command-and-control channels. The campaign highlights a growing tactic in which trusted developer ecosystems and mainstream cloud platforms are combined to hide malware delivery and stolen-data transfers.
Jun 29, 2026
Threat researchers reported multiple **remote access trojan (RAT)** developments that emphasize stealth, surveillance, and post-exploitation flexibility. A new **Remcos RAT** variant was observed adding real-time surveillance features (including on-demand webcam streaming) and keystroke transmission, while improving evasion through modular DLL plugins, encrypted C2 with in-memory-only config decryption, and dynamic API resolution; it also attempts to reduce forensic artifacts by deleting collected data (e.g., screenshots, audio, keylogging output, cookies) and removing persistence-related registry entries. Separately, Elastic detailed a **ClickFix** social-engineering campaign that uses compromised legitimate websites as delivery infrastructure to deploy a previously undocumented Windows RAT dubbed **MIMICRAT** (*AstarionRAT*). The intrusion chain includes a multi-stage PowerShell flow with **ETW and AMSI bypass**, a Lua-based shellcode loader, and HTTPS C2 on port `443` using traffic patterns designed to resemble web analytics; the implant supports token impersonation, SOCKS5 tunneling, and a broad command set, with suspected end goals of **ransomware deployment or data theft**. In parallel mobile-focused reporting, Zimperium described **ZeroDayRAT**, a cross-platform Android/iOS spyware-style RAT distributed via social engineering and sideloaded apps, enabling screen capture, keylogging, and credential/file exfiltration, highlighting continued convergence of surveillance and remote-control capabilities across endpoints.
Jun 29, 2026
Researchers detailed **Klingon RAT**, a Golang-based remote access trojan active since at least 2019 and assessed to be operated by financially motivated cybercriminals. The malware uses extensive custom code and encrypted TLS communications with command-and-control infrastructure, with a primary server identified at `185.188.183[.]144:1141` alongside additional related indicators. Klingon RAT collects host and network information, maintains persistence through multiple mechanisms, and attempts to evade defenses by terminating antivirus processes. The malware gives operators broad post-compromise control, including reverse shell access, SOCKS proxying, RDP, arbitrary binary execution, updates, and PowerShell execution. Researchers also reported several privilege-escalation options, including a UAC bypass technique associated with **Event Viewer**, and said the malware can deploy tools such as **PAExec** and an LSASS memory dumper to expand access and harvest credentials, underscoring its utility as a full-featured intrusion platform.
Aug 14, 2026