Loading story…
Threat actors abused trusted developer distribution channels to deliver malware by impersonating popular tools. Research described a campaign that forked the official GitHub Desktop repository, altered README download links to point to a malicious Windows installer, and then drove victims to the poisoned links via sponsored ads targeting searches for “GitHub Desktop.” The technique leveraged GitHub behavior where commits from forks can remain visible under the upstream project’s namespace even after the attacker’s fork/account is deleted (a form of repo squatting), complicating takedown efforts; the observed payload (GitHubDesktopSetup-x64.exe, ~127.68 MB) functioned as a multi-stage loader, and similar installer-themed lures (e.g., Chrome, Notion, 1Password, Bitwarden) were reported in related activity.
Separately, a fake “ClawdBot Agent” VS Code extension was identified as a functional trojan that executed automatically on VS Code startup ("activationEvents": ["onStartupFinished"]) and dropped malware on Windows systems; the legitimate Clawdbot project reportedly had no official VS Code extension, enabling name-squatting/impersonation. The extension fetched configuration from http://clawdbot.getintwopc[.]site/config.json and installed a ScreenConnect RAT, and it was reported to Microsoft and removed. Two additional posts about Clawdbot focused on general SOC monitoring and broader “AI agent” security considerations rather than the specific malware/impersonation incidents.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
After being notified, Microsoft removed the malicious "ClawdBot Agent" extension from the Visual Studio Code marketplace.
Analysis showed the extension fetched remote configuration, downloaded a weaponized ConnectWise ScreenConnect client configured to connect to attacker-controlled infrastructure, and also used a Rust-based malicious DWrite.dll sideloading path with multiple fallback delivery mechanisms.
On January 27, 2026, a newly published VS Code extension named "ClawdBot Agent" was identified as a trojan posing as an AI coding assistant that automatically dropped malware on Windows when VS Code started.
GMO Cybersecurity reported that the fake GitHub Desktop Windows installer used a multi-stage loader disguised as a C++ app but actually built as a single-file .NET AppHost, with GPU-dependent anti-sandbox checks and code-misdirection to hinder analysis.
From September to October 2025, attackers targeted developers, mainly in Europe and the EEA, by promoting sponsored ads for "GitHub Desktop" and using a fork of the official GitHub Desktop repository with altered download links to deliver a trojanized installer.
By May 2025, attackers were distributing trojanized installers masquerading as Chrome, Notion, 1Password, and Bitwarden, indicating the start of a broader malware campaign using fake software downloads.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported **malicious Visual Studio Code extensions** being used as a software supply-chain vector to compromise developer workstations. One campaign impersonated a viral AI coding assistant (“**ClawdBot**”) via a fake extension (“ClawdBot Agent”) that appeared legitimate and even functioned as an AI assistant by integrating real APIs (e.g., OpenAI/Anthropic/Google), while **silently dropping malware on Windows at VS Code startup**. The observed payload delivery used camouflage filenames such as `Lightshot.exe` (and references to `Lightshot.dll`) and an Electron-style bundle name `Code.exe`, indicating an effort to blend into common developer tooling and evolve the dropper over time. A separate finding described an **Open VSX** extension masquerading as a popular **Angular Language Service** for VS Code, which bundled legitimate dependencies (e.g., `@angular/language-service` and `typescript`) alongside a **malicious loader** that activates when users open HTML or TypeScript files (`onLanguage:html`, `onLanguage:typescript`). The loader decrypts an embedded payload using **AES-256-CBC** (Node.js `crypto`), with a hardcoded IV and a large hex-encoded ciphertext, then delays and executes the decrypted code—behavior consistent with staged malware delivery and potential worm-like propagation through widely installed editor extensions.
Jun 29, 2026
Security researchers reported multiple **software supply chain-style malware distribution** efforts abusing developer-adjacent platforms. JFrog detailed a malicious npm package, `@openclaw-ai/openclawai`, masquerading as an *OpenClaw* CLI installer; once executed, it uses a `postinstall` hook to reinstall globally and drop an obfuscated first-stage (`setup.js`) that deploys a multi-stage payload internally identified as **GhostLoader** (campaign tracked as **GhostClaw**). The malware is designed to persist and exfiltrate a broad set of sensitive data from developer workstations, including credentials (e.g., cloud config artifacts for **AWS/GCP/Azure**), macOS Keychain data, browser sessions, SSH keys, and cryptocurrency wallet/seed material. Separately, Trend Micro reported a large-scale distribution operation for the **BoryptGrab** information stealer via **100+ public GitHub repositories** that pose as legitimate tools and game cheats. The campaign uses SEO manipulation (keyword-stuffed READMEs and lookalike download pages) to drive victims from search results into redirect chains that ultimately deliver ZIP archives containing the stealer; some variants also deploy a PyInstaller backdoor (**TunnesshClient**) that establishes a reverse SSH tunnel for attacker communications. Reported indicators (e.g., Russian-language comments and related infrastructure) suggest a possible Russian nexus, and the observed targeting focuses on harvesting browser data, crypto wallets, system information, and user files.
Jun 29, 2026
Threat actors are abusing interest in AI developer tools by impersonating installers and setup guides to trick users into executing malware. Fake installation-guide pages for Anthropic’s **Claude Code** were promoted via **Google Ads** to rank highly for searches like “Claude Code install/CLI,” leading Windows and macOS users to run copy-pasted commands in an **InstallFix** campaign (a variant of **ClickFix**) that ultimately deployed **Amatera** (an **ACR Stealer**-based MaaS infostealer). Push Security reported the malware steals browser-stored credentials, cookies, session tokens, and system information, and the infrastructure used legitimate hosting/CDN services (e.g., *Squarespace*, *Cloudflare Pages*, *Tencent EdgeOne*) to reduce suspicion. In a related AI-tool impersonation theme, JFrog identified a malicious **npm** package, `@openclaw-ai/openclawai`, posing as an **OpenClaw** installer that targets macOS users to steal credentials and establish persistent remote access. The package uses a `postinstall` hook to reinstall itself globally and registers a CLI via the `bin` field pointing to `scripts/setup.js`, which presents a fake installer UI and then prompts for the user’s system password via a bogus Keychain/iCloud authorization flow. The malware (self-identified as **GhostLoader**) was reported to collect browser data, crypto wallets, SSH keys, Apple Keychain databases, and iMessage history, while also deploying a **RAT** with **SOCKS5 proxy** capability and “live browser session cloning,” indicating a blend of credential theft and long-term access objectives.
Jun 29, 2026