Warden Stealer Spreads Through ClickFix, Malvertising, Cracked Software and Game Cheats
Gen Digital details Warden Stealer, a Rust MaaS infostealer spread via ClickFix, malvertising, cracked software, and fake game cheats stealing browser, wallet, and AI tokens.
Warden Stealer is a malware-as-a-service Windows infostealer written in Rust, first observed in May 2026 and promoted publicly since August 2026, linked by Gen Threat Labs to the previously tracked CallbackBeaver family. It steals browser data, passwords, cookies, cryptocurrency wallets, and files, bypasses Chromium Application-Bound Encryption by recovering the v20_master_key from browser memory, and includes a crypto clipper plus loader using VirtualAllocEx/WriteProcessMemory/CreateRemoteThread injection. It also targets locally stored AI assistant and coding agent data from Claude, Codex, Grok, and Cursor, including tokens, MCP configs, and credentials.