Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data
Warden Stealer, a Rust malware-as-a-service, harvests tokens and prompts from Claude, Codex, Grok, and Cursor.
78
- Mentions · 7d0
- Mentions · 30d3
- All mentions8
- First seenSep 9, 2026
- Last mentioned21d ago
Timeline
8 articles · newest firstNew 2CLoader Malware Evades Security Tools to Deploy Vidar and Remus Stealers
Zscaler found 2CLoader, a Windows loader delivering Vidar, Remus, and XWorm while evading analysis.
58
New 2CLoader Malware Uses Anti-VM and API Hooking to Deliver Vidar and Remus Stealers
Zscaler details 2CLoader, a Windows loader using anti-VM checks and API hooks to deploy Vidar and Remus.
64
2CLoader: A New Malware Loader Delivering Vidar and Remus
Zscaler details 2CLoader, a new malware loader that delivers the Vidar and Remus payloads.
63
Remus Infostealer Removes Syscall Hooks to Evade EDR and Steal Sensitive Credentials
New Remus Windows infostealer removes syscall hooks to evade EDR, stealing browser credentials, crypto wallets, and AI tool data via ClickFix lures and EtherHiding C2.
58
New Remus Infostealer Steals OpenAI and Anthropic API Tokens, Passwords and Crypto Wallets
SpyCloud Labs details Remus, a Windows infostealer harvesting AI platform API tokens, passwords, 2FA artifacts, and crypto wallets.
68
Hackers Target Claude, Cursor and Codex AI Agents to Steal Tokens and Prompt Histories
Gen Digital found infostealers like Amatera and Remus stealing AI coding agent tokens, prompt histories, and MCP configs from infected Windows and macOS machines.
58
Infostealers Target Claude, Cursor, Codex and Other AI Agents to Steal Credentials and Sensitive Data
Gen Digital researchers report infostealer families Amatera, Remus and CallbackBeaver now harvest Claude, Cursor and Codex agent data, including tokens and MCP configs.
62
Appears with
- Windowsproduct · 4
- Vidarmalware · 4
- Codexproduct · 4
- Cursorproduct · 4
- Gen Digitalvendor · 3
- 2CLoadermalware · 3
- Claudeproduct · 3
- OpenCodeproduct · 3
- CallbackBeavermalware · 3
- Zscalerorganization · 3
- Amateramalware · 2
- Continueproduct · 2
- APEX Stealermalware · 2
- Djinn Stealermalware · 2
- Claudeai model · 2
- Clineproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.