Infostealers Are Actively Hunting AI Agents and Developer Keys – Warden Infostealer

Initial announcement and feature breakdown of Warden Stealer on the Exploit.in dark web forum.

A highly sophisticated piece of malware known as Warden Stealer has been rapidly gaining traction on dark web forums. Billed by its creators as an “all-in-one” stealer, clipper, and loader, Warden is not just another run-of-the-mill infostealer. It represents a terrifying evolution in malware-as-a-service (MaaS), combining devastating crypto-draining features with a highly targeted approach to stealing developer and AI credentials.

What Makes Warden Stealer Different?

The infostealer market is crowded, but Warden distinguishes itself through advanced evasion techniques and a highly resilient infrastructure. Here is what sets it apart from the pack:

• Proprietary Binary Transfer Protocol: Unlike most stealers that use easily detectable HTTP or JSON requests, Warden uses a custom, heavily encrypted protocol. The traffic is unreadable on the fly by network sensors, allowing it to bypass standard intrusion detection systems.
• True AST/LLVM Morphing: Warden doesn’t rely on basic obfuscators. It utilizes a custom “morpher” based on AST code parsing and LLVM IR passes. This alters the layout of the binary and injects mathematical garbage instructions, effectively rendering signature-based antivirus tools (like Windows Defender and Avast) useless.
• Server-Side Decryption: To minimize its footprint on the victim’s machine, the Warden build does zero cryptography or dangerous logic at runtime. All heavy lifting and decryption are handled on the attacker’s servers, making it incredibly lightweight (~350kb) and stealthy.
• Zero Duplicates & Chunked Delivery: The malware sends data in chunks. If the victim’s connection drops, the partial log is already saved on the attacker’s panel. Furthermore, it ties sessions to hardware IDs, ensuring attackers aren’t bogged down by duplicate logs.

Terrifying Capabilities: Over 360+ Targets

Warden’s grabber is voracious. It targets over 360 applications across 13 categories, including messengers (Discord, Telegram), gaming clients (Steam), password managers, VPNs, and FTP clients. It dynamically collects all Chromium and Gecko browser profiles, grabbing passwords, history, autofill data, and full session cookies – capable of restoring live, authenticated sessions.

The sleek, modern Warden command-and-control (C2) dashboard used by affiliates to manage stolen logs and track hit rates.

Threat intelligence from Hudson Rock’s Cavalier platform reveals the massive scale of the operation, showing tens of thousands of machines already compromised by Warden.

The AI Developer Threat

Perhaps the most alarming update (v1.9) is Warden’s explicit targeting of AI coding agents and developer environments. As evidenced by leaked payload folders, the malware actively targets directories for Claude Code, Codex CLI, Discord, GitHub, and SSH Keys.

Compromised application directories extracted by Warden, found in Hudson Rock’s Cavalier, showcasing specific targeting of developer tools like Claude Code and Codex CLI.

Furthermore, log extractions (such as a compromised .claude.json file) show the stealer successfully exfiltrating raw primaryApiKey values and detailed OAuth account data tied to Anthropic/Claude accounts. By grabbing these CLI tokens, attackers are bypassing traditional web logins entirely, gaining direct, programmatic access to premium AI models, organizational workspaces, and potentially sensitive source code passing through these tools.

A stolen .claude.json configuration file exposing an active primaryApiKey, granting attackers programmatic access to the victim’s AI limits and workspaces.

Exfiltrated SSH config and known_hosts files. This data is critical for attackers looking to pivot and execute lateral movement into corporate infrastructure.

System information file retrieved by the stealer, proudly bearing the “Stealed by Warden” tag alongside victim hardware details.

Crypto Devastation: Auto-Bruteforcing Wallets

While developer keys are lucrative, Warden’s approach to cryptocurrency is purely devastating. It supports over 200 crypto wallet extensions and desktop apps, covering 96 different networks (EVM and non-EVM alike).

However, the real game-changer is its Auto-Bruteforce Engine. When Warden steals an encrypted wallet, it doesn’t just rely on standard password lists. It dynamically builds a custom dictionary from the victim’s own stolen log – using their browser passwords, logins, emails, search queries, and autocomplete data. It then applies over 490 mutation rules, generating up to 20 million password candidates per wallet.

The financial impact is staggering. In a recent update, the developers boasted about the efficiency of their new checker and bruter engine. Over just a few days, the system scanned over 61,700 addresses, successfully cracking 66% of wallets that contained a balance. The developers claim this single run netted attackers a cumulative volume of over $485,000.

Warden’s developers boasting on the forums about nearly half a million dollars stolen via their dictionary auto-bruteforce engine over just a few days.

Inside the Minds of the Threat Actors: An Interview with Warden

To completely understand what’s going on in a market that has been growing rapidly over the last few years, it is mandatory to know which players are dominating it. A recent brief interview conducted by security researcher g0njxa sheds light on the philosophy and technical choices behind Warden.

Note: The interview was originally conducted in Russian. Both the original text and English translations are provided below.

Conclusion

Warden Stealer is a prime example of the professionalization of cybercrime. With subscription tiers reaching up to $1,500/month for “Enterprise” users, dedicated customer support, and continuous feature updates, it operates like a legitimate SaaS company. Its ability to silently bypass modern AV, coupled with its aggressive targeting of both AI developer tools and cryptocurrency, makes it a critical threat that security teams and developers must actively defend against.