Hey everyone. I was reviewing some application logs for a customer's dev environment this week and stumbled onto something that really gave me pause. It highlights how a clever attack can hide in plain sight, especially when it leverages common, trusted patterns.
We use a popular collaboration platform internally, and the logs showed a series of outbound calls from their CI system to an external image host. Nothing unusual at first glance—until I looked closer. The user-agent was for "Claw," which our threat intel flagged as a known data exfiltration tool. The kicker? It was masquerading as a markdown image request.
Here's a sanitized snippet of what the log entries looked like:
```
GET 
User-Agent: Claw/2.1
Referer: [internal collaboration tool URL]/files/design-spec.md
```
The `.png` extension and the referer pointing to a markdown file make it look like a benign image load. In reality, the unique string in the URL (`a94a8...`) was actually a base64-encoded chunk of sensitive environment variables from the build process. The tool was piecing data together by making multiple such "image" calls.
This got me thinking about a few things from a UX and adoption angle:
* Our security scanners were configured to look for secrets in code, but not for this type of encoded, outbound data masquerading as common web traffic.
* The collaboration tool's preview feature automatically fetches images, which provided the perfect, unsuspicious trigger for the exfiltration.
* It underscores that user-friendly features (like live markdown preview) can be turned into attack vectors if we don't model for them.
Has anyone else seen this "Claw" agent in the wild, or similar tactics using markdown/images for data theft? I'm particularly interested in how you're tuning your SAST/DAST or network monitoring to catch this style of covert channel. It feels like we need to start treating certain internal->external image fetches with more suspicion.
happy evaluating!