Warden Stealer malware now targets local Cursor, Claude, Codex and MCP credentials, Gen Digital says
Summary
Gen Digital's Threat Labs reported on Oct 8, 2026 that Warden Stealer, a Rust malware-as-a-service infostealer active since mid-2026, steals configuration files and local data from AI assistants and coding agents such as Claude, Codex, Grok and Cursor. Depending on the agent, that can include access and refresh tokens, credentials stored in MCP configs, prompt histories and conversation databases. Gen Digital says AI-agent collection was not in the original advertisement but became an official feature in Warden version 1.9, announced Sep 29, 2026. Broadcom published a protection bulletin on Oct 14 summarizing the same targeting. This is malware aimed at AI coding-tool data on infected Windows machines, not a flaw in Cursor, Claude or Codex.
Severity
Timeline
Gen Digital begins seeing early builds it later attributes to Warden (under the temporary name CallbackBeaver).
Authors say the project went public (per Gen Digital's attribution notes).
Warden is promoted on underground forums; prevalence rises.
Warden 1.9 announces official collection of tokens from AI coding agents.
Gen Digital publishes its technical analysis and attribution of CallbackBeaver to Warden.
Broadcom publishes a protection bulletin on Warden Stealer's AI-agent targeting.
How it happened
Warden is sold as MaaS with its own loader and a built-in cryptocurrency clipper. Operators deliver it through cracked software, game cheats, malvertising and ClickFix campaigns. Once on a Windows host, builds collect browser data (including an Application-Bound Encryption bypass Gen Digital describes) and, in a substantial subset of builds, local AI-agent files. Gen Digital's related research on the wider trend also lists Cline, Continue, OpenCode and others among agent data that stealers now grab. Version 1.9 made AI coding-agent token collection an advertised feature rather than only a custom operator rule.
How to check your app
- Treat any machine that ran cracked software, cheats or unexpected ClickFix prompts as potentially compromised: rotate Cursor, Claude, Codex and other agent tokens, MCP API keys and related cloud credentials.
- Keep AI agent configs and MCP credential files out of world-readable paths; prefer OS keychain or short-lived tokens where the tool supports them.
- Use endpoint protection that blocks known Warden loader and stealer hashes; Broadcom and Gen Digital publish indicator lists.
Sources
- Gen Digital: Warden Stealer technical analysis
- Gen Digital: Infostealers Have Found a New Target: Your AI Agent
- Threadlinqs: Warden Stealer (CallbackBeaver) threat record TL-2026-3113