Cybersecurity Headlines Sandbox flaw exposes n8n instances, Fake Moltbot assistant drops malware, PeckBirdy takes flight for cross-platform attacks
36 snips
Jan 29, 2026 A sandbox escape in n8n lets attackers achieve remote code execution on self-hosted instances. A malicious VS Code extension posing as an AI assistant installs persistent remote-access malware. A modular cross-platform espionage framework called PeckBirdy is being used for sophisticated surveillance and data theft.
AI Snips
Chapters
Transcript
Episode notes
Vet IDE Extensions Before Installing
- Avoid installing unofficial IDE extensions claiming to be popular AI assistants without verifying publisher and integrity.
- Audit developer tools for bundled binaries and monitor for unexpected remote-access clients like Screen Connect.
Malicious VS Code Extension Strategy
- A fake MoltBot/ClaudeBot VS Code extension delivered malware and persistent remote access via Screen Connect.
- The malicious extension used multiple fallback payload methods and exploited MoltBot's popularity despite no official plugin.
Detect Living-Off-The-Land JavaScript Abuse
- Monitor for living-off-the-land JavaScript abuse and suspicious use of legitimate binaries to detect PeckBirdie-style attacks.
- Harden update channels and verify software updates to prevent fake-update delivery of backdoors.