Fake AI Assistant: Malicious “ClawdBot” Extension Hides Trojan in VS Code

A malicious VS Code extension impersonating the popular 'ClawdBot' (named “ClawdBot Agent”) was discovered deploying a trojanized payload to Windows systems while appearing as a fully functional AI coding assistant. The dropper used filenames like Lightshot.exe/Lightshot.dll or an Electron bundle (Code.exe), and command-and-control activity was traced to darkgptprivate.com (hosted in Seychelles) with Cloudflare fronting and fallback mechanisms. Microsoft removed the extension after ~21 installs; the incident demonstrates high attacker sophistication and the risk of supply-chain/extension impersonation against developers.