Skip to main content
CPEBuddy
Clawdbot Malware

Clawdbot Malware

Source: YouTube · John Hammond · published Jan 27, 2026 · 43:12

Malware Analysis
No ratings yet Log in to rate
Transcript Available
Description

This video investigates a malicious "Claudebot" Visual Studio Code extension that poses as an AI coding assistant but actually attempts to install the Screen Connect remote access trojan (RAT) 0:00-0:08.

Key Takeaways:
• The extension is illegitimate and not affiliated with the real Claudebot team, instead riding the wave of AI hype to infect users 1:24-1:48.
• The malware executes via a VS Code extension that fetches a configuration file to trigger secondary downloads, though the initial version contains logic errors 9:00-9:31.
• A Rust-based DLL loader (dwight.dll) is used for DLL side-loading to deploy a weaponized Screen Connect installer, which was analyzed using IDA Pro 31:00-31:37.
• The threat actors actively updated the extension, removing the malicious payload entirely in version 3.0 after version 1.0 was found to be broken 38:14-39:53.

Although the malware appeared to be "vibe-coded" and non-functional, the campaign highlights how attackers exploit AI trends to distribute tools like Screen Connect 42:44-43:07.

Sources:

  • 0:00 Intro to the fake Claudebot extension and Screen Connect RAT
  • 1:24 Illegitimate nature of the extension
  • 9:00 Analysis of extension activation and config fetching
  • 31:00 Analysis of Screen Connect installer and Rust DLL
  • 38:14 Comparison of version 1.0 and 3.0 functionality
  • 42:44 Closing

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 0.5 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

Well guys, it was only a matter of time. Fake Claudebot VS Code extension installs Screen Connect RAT, a remote access tool. If you haven't heard of this Claudebot thing that the AI world of the internet has been screaming and shouting about all the rage this past weekend, it's supposed to be a personal AI assistant. An AI that just does things, get stuff done. Now, they've actually uh renamed this to be Moltbot because I think Anthropic wanted them to change the name. I've actually been live streaming some of the Claudebot security implications and setup. So, if you're interested, that's always on YouTube, Twitch, LinkedIn, Twitter, kind of trying to stream and multiream everywhere. There are a lot of really interesting things to talk about with Claudebot or Maltbot because, well, you've …