Is Tailscale Safe? Mesh VPN Risks Attackers Now Exploit

On September 25, 2026, Malwarebytes reported that the Kothamine remote-access trojan (RAT) uses tailcat, an open-source tool published by Tailscale, to receive commands from its operator. There’s no malicious domain to block, no Tailscale account involved, and nothing in an admin console for anyone to review. Kothamine is the newest entry in a pattern that goes back years: attackers turning Tailscale and other mesh VPNs into backdoors.