FAKE CLAWDBOT VS CODE EXTENSION INSTALLS SCREENCONNECT RAT

Summary from the TLDR InfoSec newsletter

Aikido Security discovered a trojanized "ClawdBot Agent" VS Code extension impersonating the viral AI assistant Clawdbot, which deploys weaponized ConnectWise ScreenConnect software (Code.exe) configured to connect to attacker infrastructure. Microsoft quickly removed the extension after disclosure. The malware features a sophisticated multi-layered payload delivery. The attack demonstrates advanced evasion through functional AI features to avoid suspicion, process camouflage using legitimate VS Code executable names, DLL sideloading with anti-analysis timing checks, and quadruple impersonation layers that successfully weaponize trusted remote administration software.