WARDEN Stealer, a Rust-based infostealer also known to Gen Threat Labs as CallbackBeaver, has emerged on underground forums since August 2026 and is now considered one of the more prevalent threats in its category. The malware is sold as malware‑as‑a‑service, with tiered access plans (Personal and Enterprise) and claimed active customer counts, though Gen highlights that independent verification of these figures is lacking.
The campaign uses a built‑in loader and can deploy via multiple delivery channels, including cracked software, game cheats, malvertising, and ClickFix campaigns. The loader reconstructs the stealer in memory and supports three modes: injection, DLL sideloading, and a standalone build.
Infection begins with the loader decoding the payload and injecting into a trusted process, typically explorer[.]exe, though samples may also run standalone. The loaders employ heavy obfuscation, padding to bypass antivirus and sandboxes, and anti‑VM checks that halt execution if virtual environments are detected. Once active, the stealer communicates with one to five hardcoded C2 domains over HTTPS and Uploads data in batches, with the ability to download additional payloads.
Its notable targets include AI agents and coding tools, where it exfiltrates configuration files, tokens, and local data such as prompts and credentials. It also aims to steal browser data by bypassing Application‑Bound Encryption to decrypt master keys in memory, and it includes a built‑in crypto clipper that can swap wallet addresses across multiple networks. Gen attributes CallbackBeaver and Warden to the same actors, operating from Russian‑speaking circles, though the authors’ location remains unknown.
Defense guidance in the report emphasises avoidance of cracked software, token vaulting and rotation, monitoring for abnormal explorer memory writes, and scrutiny of unusually large executables with heavy padding.