Warden Stealer Malware Targets Claude, Codex, Grok and Cursor to Steal AI Agent Data

**Warden Stealer** is a Rust-based infostealer actively marketed as a malware-as-a-service that harvests AI-assistant and coding-agent data (tokens, API keys, prompts, conversation histories, MCP settings) along with browser secrets, wallets, and password stores; it includes a loader, cryptocurrency clipper, anti-VM checks, and an ABE bypass technique via in-process decryption. The report details delivery vectors (cracked software, malvertising, ClickFix), technical TTPs (custom packing/obfuscation, process injection into explorer.exe/browser, dynamic decoding), affiliate-configurable builds, and provides SHA-256 hashes as indicators of compromise.