Warden Stealer Infostealer Steals AI Agent Tokens and Browser Data via Rust Malware
Kiran 
Gen Threat Labs says Warden Stealer is a Rust-based malware-as-a-service infostealer. It is now among the most common infostealers in Gen’s user base, alongside Vidar, Amatera, and Remus. It also collects data from AI coding agents, including tokens, MCP credentials and prompt histories.
Gen researchers Vojtěch Krejsa and Jan Rubín say the malware has been promoted on Russian-language underground forums since August 2026. Gen has tracked its earliest builds since May 2026. The authors claim a public launch on July 21 and about 110 active customers.
Gen first tracked the malware as CallbackBeaver. It later tied that name to Warden Stealer. The samples carry no brand strings, so the link rests on several matches with the authors’ own claims.
Warden Stealer Infostealer Steals AI Agent Tokens
These include the Rust codebase, the timeline, the bundled loader, and a crypto clipper whose supported coins match the advertised list in the same order.
The malware avoids systems in CIS and Baltic countries. That suggests the developers work within Russian-speaking cybercrime circles, though Gen says this does not prove their origin.
Warden is one of the first stealers seen targeting files from Claude, Codex, Grok, and Cursor. Depending on the tool, these files can hold access and refresh tokens, MCP credentials, conversation databases, and traces of a developer’s projects. An attacker gets both account access and the context to find what is worth stealing.
AI agent theft was not in the original advertisement. It first appeared through operator-defined collection rules. Version 1.9, announced September 29, made it an official feature. Prices also rose with that release: the Personal plan went from $349 to $450 a month, Premium from $499 to $800, and a new $1,500 Enterprise tier was added.
Loader. Warden ships with its own loader, which is unusual for this market. In the common injection mode, the loader rebuilds the payload in memory and injects it into the process that owns the taskbar window (normally explorer.exe). Loaders often pad themselves with a large overlay to slip past size limits in scanners and sandboxes.
Obfuscation. The authors market it as a true “morpher” built on AST parsing and LLVM IR passes. Strings use a build-specific Base64-like alphabet plus LZSS-style compression. Builds also use dynamic API resolution, opaque predicates, and junk code.
Anti-VM checks. It inspects SMBIOS tables, CPUID hypervisor IDs, VirtIO software, and generic display adapters. If it detects a VM, it shows a DEBUG message box and stops.
ABE bypass. Warden scans browser memory for the v20\x00 tag and filters candidates by their layout. It then injects shellcode into a hijacked browser thread. The shellcode calls CryptUnprotectMemory to decrypt the Chromium v20 master key. Gen says this resembles a mix of the Vidar and Remus techniques but looks independently developed.
C2 and extra payloads. Each build holds one to five XOR-protected C2 domains. Traffic goes over HTTPS in a custom compressed format. The server returns a dynamic configuration, which can include URLs for further payloads. These are fetched with certutil and run through hidden cmd.exe commands.
Mitigation
Delivery depends on the operator. Gen has seen cracked software, game cheats, malvertising, and ClickFix lures. Defenders should take these steps:
- Treat AI agent configuration folders and tokens as credentials.
- Rotate exposed tokens after any infection.
- Watch for certutil
-urlcachedownloads launched from cmd.exe. - Watch for remote threads created in explorer.exe.
- Block pirated software and ClickFix lures.
Gen has published indicators of compromise and a sample configuration on its GitHub.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
George antony 
