TI Mindmap HUB
Threat Intelligence Report

Fake Clawdbot VS Code Extension Installs ScreenConnect RAT

📅 February 5, 2026 📰 www.aikido.dev 🔍 0 CVE(s) referenced

A fake "ClawdBot Agent" VS Code extension posed as a legitimate AI assistant while covertly installing a weaponized ScreenConnect remote access trojan, leveraging multiple redundant delivery mechanisms and sophisticated camouflage to grant attackers persistent, stealthy control over compromised developer machines.

vendor

Sign in to access the full report including:
detailed analysis, IOCs, MITRE ATT&CK mapping, and STIX bundle.

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap
🎯 IOC Extraction
⚔️ MITRE ATT&CK TTPs
📦 STIX 2.1 Bundle