Research reports

Warden Stealer: The Rapid Rise of an Infostealer with an Appetite for AI Agent Data

Gen Threat Labs has been tracking Warden Stealer, an emerging and actively developed malware-as-a-service (MaaS) infostealer written in the Rust programming language that has, within just a few months, already become one of the most prevalent infostealers in…

MalwareInfostealers

WordlistLoader Delivering Amatera via ClearFake Campaigns

Gen Threat Labs has identified WordlistLoader, a new loader used to deliver Amatera Stealer via ClearFake campaigns. Amatera has been actively developed over the past few months and has gradually become one of the most prevalent infostealers in our user base.…

Infostealers

VoidStealer: Debugging Chrome to Steal Its Secrets

VoidStealer is the first infostealer observed in the wild adopting a novel debugger-based Application-Bound Encryption (ABE) bypass technique that leverages hardware breakpoints to extract the v20_master_key directly from browser memory. The bypass requires…

When Malware Authors Study Algebra: The Group Theory Inside Bedep's DGA

TLDR: Bedep was a malware family active mainly in 2014 and 2015 that used an unusually sophisticated domain generation algorithm, or DGA, to hide its command-and-control infrastructure. Instead of relying only on the date, it used real foreign exchange rates…

Malware