Beware of Weaponized VS Code Extension Named ClawdBot Agent that Deploys ScreenConnect RAT

A fake VS Code extension named “ClawdBot Agent” (discovered 2026-01-27) posed as an AI assistant but contained a dropper that installed malware on Windows. The payload deployed a preconfigured ScreenConnect client that connected to attacker-controlled servers (meeting.bulletmailer.net:8041) and used a Rust DLL to fetch backup payloads from Dropbox disguised as a Zoom update, providing persistent remote access. The extension integrated with legitimate AI providers to appear trustworthy, executed on VS Code startup, and included multiple fallback mechanisms; Microsoft removed the extension after detection and analysts advise immediate removal, blocking of infrastructure, and rotating API keys.