Skip to content
Bulwark Black Bulwark Black LLC
Latest
Jscrambler npm Compromise Shows Build Pipelines Need Runtime ControlsGhost Phishing Shows Why Email Security Must Follow the BrowserPakistani Police Intrusions Show Why Public-Sector Data Systems Are Strategic TargetsBad Epoll Shows Linux Kernel LPEs Belong in the Patch Priority QueueFake Payment SDKs Show Why Dependency Risk Is Credential RiskCritical UniFi Flaws Put Network Control Planes Back in the Patch QueueVidar Stealer Campaign Shows Why File Size and Fake Signatures Still Beat Weak ControlsADFS Signing Keys Show Why Federation Servers Are Tier-Zero Identity InfrastructureUAT-7810 Shows Edge Devices Are Becoming China-Nexus Relay InfrastructureFortiBleed Shows Firewall Credentials Are Ransomware FuelNetNut and Popa Takedown Shows Residential Proxies Are Now Attack InfrastructureVect and TeamPCP Show Supply-Chain Credentials Are Ransomware FuelOusaban Shows Banking Trojans Are Learning to Hide From SandboxesNUT upsmon Command Injection Shows UPS Monitoring Belongs in the Patch Queue

Indicator of Compromise

e20b920c7af988aa215c95bbaa365d005dd673544ab7e3577b60fecf11dcdea2

SHA-256 hash Seen in 1 report Watch this →

A SHA-256 file hash identifying a specific malicious sample. Match it against files on disk or in your EDR.

Included in the Hashes feed (live, machine-readable).

Seen in these reports

Malware · Jan 27, 2026

Fake Clawdbot VS Code Extension Deploys ScreenConnect RAT

Related indicators

Indicators that appear alongside this one in the same reporting, often shared infrastructure or the same campaign.

04ef48b104d6ebd05ad70f6685ade26c1905495456f52dfe0fb42f550bd43388 178[.]16[.]54[.]253179[.]43[.]176[.]32 adbcdb613c04fd51936cb0863d2417604db0cd04792ab7cae02526d48944c77b bulletmailer[.]netclawdbot[.]getintwopc[.]site d1e0c26774cb8beabaf64f119652719f673fb530368d5b2166178191ad5fcbea darkgptprivate[.]comdropbox[.]com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate[.]msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&ampgetintwopc[.]sitegetintwopc[.]site/config[.]jsongetintwopc[.]site/config[.]json&#x27hxxp://clawdbot[.]getintwopc[.]site/config[.]json&#x27hxxp://clawdbot[.]getintwopc[.]site/dl/Lightshot[.]dll&#x27hxxp://clawdbot[.]getintwopc[.]site/dl/Lightshot[.]exe&#x27hxxps://darkgptprivate[.]com/d111&quothxxps://www[.]aikido[.]dev/blog/fake-clawdbot-vscode-extension-malwarehxxps://www[.]dropbox[.]com/scl/fi/tmwi4j86op04r9qo2xdgh/zoomupdate[.]msi?rlkey=ymr9yn5p3q2w2l3uz9cg71dvm&st=q93av9p6&dl=1meeting[.]bulletmailer[.]net www[.]aikido[.]dev www[.]dropbox[.]com
Browse all indicators → Machine-readable feeds → Extract IOCs from text →