Gen Threat Labs has published an analysis of Warden Stealer, a Rust-based malware-as-a-service infostealer that steals tokens and local data from AI coding assistants alongside browser passwords, cookies and cryptocurrency. The researchers describe it as one of the first infostealers observed taking configuration files and local data from AI assistants.
Warden Stealer Goes After Claude, Codex, Grok and Cursor Data
The malware, formerly tracked as CallbackBeaver, runs on Windows 8 through Windows 11. Among its targets are users of AI assistants including Claude, Codex, Grok and Cursor. It steals AI agent tokens along with the configuration files and local data of those tools.
The report notes that credentials of this kind can expose code repositories and cloud accounts, which extends the damage beyond a single compromised machine. Warden Stealer also carries the standard infostealer functions: browser passwords and cookies, with a capability to bypass Application-Bound Encryption, and a crypto clipper covering 10 networks.
Loader Modes: Injection, DLL Sideloading and Standalone
Warden Stealer includes a built-in loader that supports three modes: injection, DLL sideloading and standalone. The choice of mode gives operators flexibility in how the payload runs on a victim machine.
Distribution Through Cracked Software, Cheats and ClickFix
The malware spreads through cracked software, game cheats, malicious ads and ClickFix lures. ClickFix is a social-engineering technique in which victims are prompted to run a command themselves. Those channels reach users who download software outside official sources.
Malware-as-a-Service Pricing and Customer Claims
Warden Stealer is sold as a service. Early builds appeared in May, and forum sales began in August. Two tiers are advertised: a Personal plan at $450 per month and an Enterprise plan, version 1.9, at $1,500 per month.
The operators claim about 110 customers. That figure is unconfirmed. Gen Threat Labs suspects the operators are Russian-speaking.
Warden Stealer Timeline From First Builds to Public Analysis
The earliest builds were observed in May, the forum listing followed in August, and Gen’s analysis was published on October 12. The family has therefore been circulating for months, and the October report is the first detailed public analysis cited here.
Impact and Detection Guidance
The consequence of stolen AI agent tokens is access to whatever those agents are connected to. Developers who use AI coding assistants often link them to repositories and cloud services, so a token taken by an infostealer can become a route into those resources. The classic infostealer loot of browser passwords, session cookies and wallet funds adds to the exposure.
There is no patch for Warden Stealer, since it is malware rather than a software flaw. Gen published analysis and detection guidance for defenders.
Several details in the report are limited or unconfirmed. The customer count of about 110 comes from the operators’ own claims, and the identity of the operators is a suspicion based on language. The pricing tiers, however, give a picture of how the malware is marketed: a lower-cost plan for individual buyers and a higher-priced enterprise plan with a version number, indicating the product is still being updated.
The use of well-known lures such as cracked software and game cheats means that infections are likely to concentrate among users installing unofficial downloads, including developers who may also hold AI assistant tokens on the same machines.
Why Stolen AI Assistant Data Raises the Stakes
Gen Threat Labs frames the AI-assistant focus as the notable feature of Warden Stealer. Config files and local data from tools such as Claude, Codex, Grok and Cursor can hold the tokens that authorize an agent to act on a user’s behalf. An infostealer that takes those files collects credentials for services the user has connected, in addition to the passwords and cookies it takes from browsers.
The browser theft includes a bypass of Application-Bound Encryption, the protection that browsers use to tie stored data to the application. The crypto clipper covers 10 networks, which means copied wallet addresses can be swapped for attacker-controlled ones during transfers on those networks.
The malware targets Windows 8 through Windows 11, so a wide range of Windows installations fall within its reach. Gen’s report does not give infection numbers, and it does not say how much data has been stolen so far.
