WardenStealer / CallbackBeaver — AI-Agent Credential Theft at Operational Scale
Status
PASS
Verified Findings
None
Contradictions / Caveats
UNKNOWN: SpyCloud reports >130,000 unique WardenStealer infections ingested since 2026-08-03, establishing a large operational footprint within its collection.
Evidence boundary: Does not equal current active people/devices/organizations or downstream compromises.
UNKNOWN: Recaptured Warden logs contained Claude Code OAuth access/refresh credentials, MCP tokens/configuration, and Codex authentication material including OpenAI API key and access/refresh tokens.
Evidence boundary: Does not prove valid tokens on every host or successful downstream token reuse.
UNKNOWN: Warden is a Windows Rust MaaS infostealer with loader, crypto clipper and Chromium ABE bypass; standard AI-agent collection entered v1.9 announced 2026-09-29. Gen tracks Warden as the malware previously called CallbackBeaver.
Evidence boundary: Does not independently verify operator customers/revenue; alias resolution remains Gen-origin.
UNKNOWN: Gen documents AI-agent data collection across commodity stealers and reports CallbackBeaver targeting Cursor/Claude with >5,000 samples observed in a recent 30-day period.
Evidence boundary: Does not turn broader infostealer telemetry into Warden victim prevalence or prove downstream token abuse.
UNKNOWN: Warden artifacts are associated with ClickFix, malicious ads, fake game cheats and trojanized installers; incident response must explicitly revoke/rotate AI OAuth/refresh tokens, API keys, MCP secrets and connected sessions rather than relying on password reset alone.
Evidence boundary: Does not establish one dominant Warden initial-access vector or validity of every stolen token.
Open Follow-up
OPEN [HIGH]: DOWNSTREAM_OUTCOME — No measured Warden-specific rate of successful AI-account, repository, cloud, MCP or CI/CD misuse after token theft.
OPEN [HIGH]: VICTIM_DENOMINATOR — >130k unique SpyCloud recaptured infections do not provide a complete current active-victim, organization, sector or geographic denominator.
OPEN [MEDIUM-HIGH]: DELIVERY_ATTRIBUTION — No single primary initial-access route or per-channel contribution is established across the Warden population.
OPEN [MEDIUM]: OPERATOR_ECONOMICS — Seller/customer count, customer identity, revenue and MaaS economics remain unverified beyond public promotion/context.