ClawdBot Code.exe Masquerading in Temp

Kaung Khant Ko@kaungkhantko

•updated Jan 29, 2026•27•0•186

Detects the execution of 'Code.exe' from the '%TEMP%\Lightshot' directory. This specific path and filename combination is a strong indicator of the malicious 'ClawdBot' VS Code extension payload.