Warden Stealer Rust Infostealer Targets AI Coding Agent Tokens and Browser Data
Do Son 
Warden Stealer payload reconstruction and injection flow | Image: Gen Threat Labs
| At a glance | |
| Malware family | Warden Stealer (earlier tracked by Gen as CallbackBeaver) |
| Threat actor | Unnamed MaaS authors; suspected to operate in Russian-speaking cybercrime circles |
| Targets | Windows 8 to Windows 11 users; Gen says it is one of the most prevalent stealers in its user base |
| Delivery | Cracked software, game cheats, malvertising, and ClickFix campaigns |
| Key capabilities | Browser and wallet theft, AI agent token theft, ABE bypass, built-in loader and crypto clipper |
| Source | Gen Threat Labs research |
TL;DR
Warden Stealer appeared on underground forums in August 2026 and already ranks among the most common infostealers Gen blocks. The Rust infostealer ships with its own loader and a cryptocurrency clipper. It also steals tokens and local data from AI assistants and agentic coding tools.
A fast-growing malware-as-a-service
Gen Threat Labs first spotted early builds in May 2026. Prevalence then jumped in early August, when the authors began advertising the service. Today, Gen places Warden Stealer alongside Vidar, Amatera, and Remus as a top threat.
The authors sell access through tiered plans. According to their own ads, version 1.9 raised the Personal plan to $450 a month and added a $1,500 Enterprise tier. In an interview, they also claimed about 110 active customers. Neither figure has independent confirmation.
Delivery
Because Warden Stealer runs as malware-as-a-service, each customer picks a delivery method. As a result, Gen sees it in all the usual places. These include fake cracked software, game cheats, malicious ads, and ClickFix lures that trick users into running commands.
Infection chain
Unlike most rivals, Warden Stealer comes with an in-house loader. Gen assesses with high confidence that the same authors built both parts, since they share one obfuscation scheme. The loader rebuilds the stealer in memory and supports three modes: injection, DLL sideloading, and a standalone build.
Injection into a trusted process
Most samples use injection mode. First, the loader decodes the hidden payload with a custom Base64-style alphabet that differs per build. Next, it finds the process that owns the Windows taskbar, usually explorer.exe. It then writes the rebuilt stealer into that process and starts it on a new thread.
The loader files are often padded with huge amounts of junk data. This trick can push them past file-size limits in antivirus engines and cloud sandboxes.
Heavy morphing and anti-VM checks
The authors chose Rust for its “very good opportunities for code morphing,” they said in the interview. They even market Warden as the “only true morpher on the market (not just an obfuscator).” In practice, builds use encoded strings, dynamic API lookups, indirect jumps, and junk code.
Before stealing anything, the malware checks for a virtual machine. It inspects firmware tables, CPU vendor IDs, installed software, and display adapter names. If it detects a VM, it shows a joke message box and stops.
Command-and-control and data exfiltration
Each build carries one to five hardcoded C2 domains, with extras as fallbacks. The stealer talks to its server over HTTPS using a custom binary format. It first registers the victim with a system fingerprint, including hardware ID, OS version, username, and installed software.
The server replies with a configuration that decides what to collect. Afterward, the malware uploads stolen data in batches. It can also download and run extra payloads, such as MSI installers or batch scripts.
AI agents become a new target
The most notable feature targets AI tools such as Claude, Codex, Grok, and Cursor. Gen calls Warden Stealer “one of the first infostealers we have observed stealing configuration files and local data belonging to AI assistants and agentic coding tools.” These files can hold access tokens, MCP credentials, and prompt histories. Version 1.9 made AI token theft an official feature.
Browsers and crypto wallets
To steal Chromium cookies and passwords, the stealer bypasses Application-Bound Encryption. It hunts for the encrypted master key in browser memory. Then it hijacks a browser thread to decrypt that key in place. Meanwhile, the built-in clipper swaps copied wallet addresses across ten cryptocurrency networks, including Bitcoin, Ethereum, and Monero.
Who is behind it
Gen confirms that CallbackBeaver and Warden Stealer are the same malware. The researchers matched samples with the authors’ forum posts and a public interview. The Rust code base, the timeline, the loader, and the exact clipper network order all lined up.
The identity of the authors remains unknown. However, the malware avoids systems in CIS and Baltic countries and the ads run in Russian. So the developers are suspected to work within Russian-speaking communities, though that does not prove their location.
Defense and detection guidance
- Avoid cracked software, game cheats, and unofficial download sites.
- Never paste commands from a web page into the Run box or a terminal. ClickFix lures depend on this step.
- Store AI agent tokens and MCP secrets in a vault, and rotate them after any suspected infection.
- Monitor for unusual memory writes into explorer.exe and for certutil downloading files into temp folders.
- Flag very large executables that rely on oversized padding to dodge scanning.
- Double-check wallet addresses after pasting them, since a clipper can swap them silently.
For the full technical breakdown, read the Gen Threat Labs analysis of the Warden Stealer Rust infostealer. Given its rapid updates, Warden Stealer is likely to remain a major threat for some time.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
