{"id":1962,"date":"2026-01-29T09:16:23","date_gmt":"2026-01-29T08:16:23","guid":{"rendered":"https:\/\/ilja-schlak.de\/?p=1962"},"modified":"2026-01-29T09:31:48","modified_gmt":"2026-01-29T08:31:48","slug":"vs-code-extension-malware-fake-clawdbot-agent","status":"publish","type":"post","link":"https:\/\/ilja-schlak.de\/en\/vs-code-extension-malware-fake-clawdbot-agent\/","title":{"rendered":"VS Code Extension Malware – Fake \u201eClawdBot Agent\u201c"},"content":{"rendered":"

The VS Code Extension Malware<\/strong> \u201cClawdBot Agent\u201d disguised itself as an AI coding assistant, fetched a remote configuration when VS Code started, and installed a preconfigured ConnectWise ScreenConnect<\/em> client. This allowed attackers to establish persistent remote access to Windows systems.<\/p>\n

VS Code Extension Malware in the Marketplace: Fake \u201cClawdBot Agent\u201d installs ScreenConnect<\/h2>\n

As of:<\/strong> 29 January 2026<\/p>\n

Researchers at Aikido Security<\/a> analyzed a VS Code Extension Malware<\/strong> sample that appeared in the official Visual Studio Code Marketplace under the name \u201cClawdBot Agent \u2013 AI Coding Assistant.\u201d According to their analysis, the extension looked functional on the surface, but in the background it caused a ScreenConnect instance preconfigured for attacker use to be installed on Windows systems and automatically connected to attacker-controlled infrastructure.<\/p>\n

The listing was available under the extension ID clawdbot.clawdbot-agent<\/a> and showed 77 installs<\/strong> at the time of research. Aikido reports that, after notifying Microsoft, the extension was removed quickly; a public Microsoft statement on this specific incident has not been published so far.<\/p>\n

Timeline of the VS Code Extension Malware: discovery, reporting, removal<\/h3>\n

According to Aikido, the extension was flagged by their malware detection on 27 January 2026<\/strong>, then validated and reported to Microsoft (see the Aikido analysis<\/a>). The context and additional details (including background around Moltbot\/Clawdbot) were also covered shortly thereafter by The Hacker News<\/a>.<\/p>\n

How the VS Code Extension Malware works: the infection chain<\/h3>\n

The VS Code Extension Malware<\/strong> was configured to activate automatically when the IDE starts (onStartupFinished<\/em>). First, it downloads a file called config.json<\/em> from an external domain; in Aikido\u2019s analysis this is clawdbot.getintwopc[.]site<\/em><\/code>. It then executes a binary named Code.exe<\/strong>.<\/p>\n

\u201cCode.exe\u201d is not necessarily \u201cclassic\u201d custom malware, but rather a legitimate ScreenConnect client that was preconfigured to connect to attacker infrastructure (Aikido cites meeting.bulletmailer[.]net:8041<\/em><\/code> as a relay\/C2 indicator). This is what makes detection harder: the software itself is legitimate, but the target configuration<\/em> is malicious.<\/p>\n

Aikido also describes fallback mechanisms: among other things, a tampered DLL (DWrite.dll<\/em><\/code>) is used for sideloading so payloads can still be fetched if the primary infrastructure is unavailable\u2014also including retrieval via a Dropbox link. This significantly increases the robustness of the attack.<\/p>\n

Why VS Code Extension Malware using \u201clegitimate tools\u201d is especially dangerous<\/h3>\n

This case highlights a pattern that frequently complicates incident response: remote admin and RMM tools (such as ScreenConnect) can look \u201cnormal\u201d in corporate environments, but are deliberately abused by attackers to establish stealthy remote access. In Aikido\u2019s analysis, this approach is explicitly described as \u201clegitimate remote software, weaponized configuration.\u201d<\/p>\n

Checks & immediate actions for VS Code Extension Malware<\/h3>\n