A VS Code extension for a "Clawdbot Agent" was fake; it was actually malware that installed ScreenConnect on a target computer to be used as a remote access trojan! YouTube video walking through the extension source code & Rust-based loader by DLL hijacking: youtu.be/7GS6Xs4hdvg Hat tip to Aikido Security and Charlie Eriksen for catching this thing in the wild -- one of the domains looks to also be hosting a panel for Evelyn Stealer malware, so we reference some other research from Trend Micro and Koi Security as well to note the similarities in the Lightshot EXE and DLL naming & abuse of VS Code extensions for fake AI coding assistants. While I was recording, the extension was changed and updated to a new version in real-time -- so we take a look at both and actually fire off the sample to see it work. ... it didn't work. (???) Looking more closely at the syntax of the extension, even recreating how it is invoked, the logic seemed wrong. Was the whole thing vibecoded? Maybe I missed something, so I need your eyes! (Or your Clawdbot Moltbot Robot Botbot bot "eyes"😜) youtube.com/watch?v=7GS6Xs4h…