Loading malware…
WardenStealer, also previously identified as CallbackBeaver, is a Rust-based Windows information stealer distributed through a malware-as-a-service model and advertised on Russian-language cybercrime forums. Its distribution methods include ClickFix lures, malicious advertisements, cracked software, and fake game cheats. It collects system information, browser passwords, cookies, autofill data, cryptocurrency information, and application data from messaging, gaming, remote-access, and FTP clients, including saved RDP connections. It also incorporates loader functionality, a cryptocurrency clipper, and a Chromium Application-Bound Encryption bypass for recovering protected browser cookies.
WardenStealer extends its collection to locally installed AI applications, including Claude Code, Claude Desktop, and Codex CLI. Stolen material includes OAuth access and refresh tokens, OpenAI API keys, authentication material for connected Model Context Protocol servers, application configuration, account identifiers, assistant instructions, and usage information. AI-application collection initially relied on operator-defined rules and became a standard capability in version 1.9 in September 2026. Recovered infection logs confirm actual theft of this material. Stolen credentials and cookies can enable unauthorized service consumption and reuse of authenticated sessions; some may remain valid after password changes. On developer endpoints, stolen configuration and authorization material can also expose connected development and cloud services.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.