Warden Infostealer Targets AI Coding Credentials and Cryptocurrency Wallets

Warden Stealer is targeting AI coding tools and developer credentials alongside browser passwords, session cookies, and cryptocurrency wallets. Hudson Rock reports that version 1.9 of the Rust-based malware targets Claude Code, Codex CLI, GitHub-related directories, and SSH data; recovered theft logs reportedly include Claude configuration files containing API keys and OAuth account information. Hudson Rock’s Cavalier intelligence indicates tens of thousands of compromised machines, highlighting the exposure of developer workstations and locally stored AI-service credentials.

Advertised on Exploit.in as a malware-as-a-service package combining an information stealer, cryptocurrency clipper, and loader, Warden claims support for more than 200 cryptocurrency wallets and automated wallet-password cracking using candidates derived from victims’ stolen data. Its developers report approximately 110 active customers and subscription tiers reaching $1,500 per month. They also claim code morphing, encrypted communications, server-side decryption, and more than $485,000 in cryptocurrency proceeds from one cracking operation; the supplied reporting does not independently verify those effectiveness or financial claims. Organizations with affected endpoints should prioritize containment, revoke exposed sessions and OAuth tokens, rotate AI API keys and developer credentials, and investigate potential downstream access to repositories and services.