Beware of Weaponized VS Code Extension Named ClawdBot Agent that Deploys ScreenConnect RAT
A fraudulent VS Code extension named "ClawdBot Agent" has been identified, targeting developers and concealing a malicious payload. Initially discovered on Fri, Jan 27, 2026, the extension masqueraded as a legitimate AI-powered assistant, misleading…
A fraudulent VS Code extension named "ClawdBot Agent" has been identified, targeting developers and concealing a malicious payload. Initially discovered on Fri, Jan 27, 2026, the extension masqueraded as a legitimate AI-powered assistant, misleading users into installation.
The extension was registered under a deceptive name before the official Clawdbot service could release its own, leading to unintentional installations. Security systems were alerted to unusual activities upon the launch of VS Code, revealing the extension's true nature.
This extension integrated with recognized AI providers, including OpenAI, Anthropic, and Google, which contributed to its perceived legitimacy. However, it covertly deployed malware on Windows systems without user consent, prompting Microsoft to remove it from their marketplace.
Aikido security analysts conducted a detailed investigation, uncovering that the extension executed code automatically at each VS Code startup. This code connected to an external server to download and execute disguised malicious files.
A fraudulent VS Code extension named "ClawdBot Agent" has been identified, targeting developers and concealing a malicious payload.
Infection Mechanism and ScreenConnect Deployment
The attackers exploited legitimate remote access software, ScreenConnect, configuring it to communicate with a server under their control at meeting.bulletmailer.net on port 8041. Victims unknowingly received a functional ScreenConnect client, establishing unauthorized remote connections.
A Rust-based DLL file provided backup capabilities, retrieving additional payloads from Dropbox disguised as a Zoom update. The attackers implemented multiple fallback mechanisms, ensuring continued operation even if primary servers were compromised.
Users who have installed this extension should uninstall it promptly, remove ScreenConnect, and block associated domains. It is advisable to rotate API keys for any AI services accessed through the extension. This incident highlights the necessity of verifying extension authenticity before installation.
Based on reporting by Cyber Security News.