Loading malware…
Warden Stealer is a Rust-based information stealer targeting Windows and sold as malware-as-a-service on underground forums. Previously tracked as CallbackBeaver, it was observed in early May 2026 and publicly promoted from August 2026. Its service model enables criminal affiliates to customize builds, configure collection targets, and operate separate command-and-control infrastructure. Distribution includes ClickFix campaigns, malvertising, poisoned search results, cracked software, and fake game cheats. ClickFix lures impersonate CAPTCHA or browser-verification checks to persuade users to execute commands that retrieve the malware.
Warden collects passwords, session cookies, browsing data, cryptocurrency-wallet information, application data, and sensitive local files. Targets include Chromium- and Gecko-based browsers, password managers, messengers, VPN clients, and two-factor authentication tools. It also targets developer credentials, GitHub-related data, SSH keys, and local artifacts belonging to Claude, Codex, Grok, and Cursor. These artifacts can expose API keys, access and refresh tokens, Model Context Protocol credentials, prompt histories, conversation databases, and project context. Version 1.9, announced in September 2026, explicitly introduced coding-agent token collection. This theft follows endpoint compromise rather than exploitation of vulnerabilities in the AI tools. A built-in cryptocurrency clipper replaces copied wallet addresses with attacker-controlled destinations.
Its dedicated loader reconstructs an embedded payload in memory and injects it into another process; deployment also supports DLL sideloading and standalone execution. Evasion techniques include build-specific encoding, extensive obfuscation, code morphing, oversized executable overlays, and virtualization checks that can terminate collection and reporting. Warden attempts to bypass Chromium Application-Bound Encryption by locating encrypted browser keys in memory and executing decryption code within the browser process. It registers infected systems using hardware and software information, receives operator-controlled collection rules, and exfiltrates collected data over HTTPS using an obfuscated, compressed binary protocol. It can also download and execute additional payloads supplied through its command-and-control configuration.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
« T1078 — Valid Accounts (Defense Evasion) »
« T1078 — Valid Accounts (Defense Evasion) »
« T1078 — Valid Accounts (Defense Evasion) »
« Morphing AST/LLVM multi-niveaux : altération du binaire à quatre niveaux (PE layout, AST, IR, ASM) »
« T1027.005 — Indicator Removal from Tools (Defense Evasion) »
« T1078 — Valid Accounts (Defense Evasion) »
« un dictionnaire personnalisé à partir des données volées de la victime [...] applique 490+ règles de mutation et génère jusqu’à 20 millions de candidats par portefeuille »
« T1539 — Steal Web Session Cookie (Credential Access) »
« Exfiltration de fichiers .claude.json contenant des primaryApiKey et données OAuth »
« 360+ applications ciblées dans 13 catégories : navigateurs Chromium/Gecko [...] gestionnaires de mots de passe » ; « T1555 — Credentials from Password Stores »
« Exfiltration de fichiers SSH (config, known_hosts) pour faciliter le mouvement latéral »
« Exfiltration de fichiers .claude.json » ; « Exfiltration de fichiers SSH (config, known_hosts) »
« T1560 — Archive Collected Data (Collection) »
« Livraison par chunks : envoi fragmenté des données, sessions liées aux hardware IDs pour éviter les doublons » ; « T1041 — Exfiltration Over C2 Channel »
71 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.