Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data
Warden Stealer, a Rust malware-as-a-service, harvests tokens and prompts from Claude, Codex, Grok, and Cursor.
78
Malware
CallbackBeaver
- Mentions · 7d0
- Mentions · 30d1
- All mentions3
- First seenSep 9, 2026
- Last mentioned21d ago
Timeline
3 articles · newest firstHackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories
Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.
58
Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data
Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.
62
Appears with
- Remusmalware · 3
- Cursorproduct · 3
- Codexproduct · 3
- Claudeproduct · 3
- Claudeai model · 2
- Otter Stealermalware · 2
- Anthropicvendor · 2
- Amateramalware · 2
- Continueproduct · 2
- STG Stealermalware · 2
- APEX Stealermalware · 2
- Gen Digitalvendor · 2
- OpenCodeproduct · 2
- Clineproduct · 2
- Djinn Stealermalware · 2
- HydraStealermalware · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.