Selected WardenStealer/CallbackBeaver 25/25. SpyCloud recaptured >130k unique Warden infections since Aug 3 and directly observed Claude Code/Codex OAuth/API/MCP credential material in Warden logs. Gen independently supports AI-agent-targeting technique and CallbackBeaver activity. Downstream token reuse/outcome remains unproven.
EVIDENCE
الأدلة وما تثبته
5 سجل
MCI-E-D2A9F4C7-01
SpyCloud reports >130,000 unique WardenStealer infections ingested since 2026-08-03, establishing a large operational footprint within its collection.
UNKNOWN
Supports
Operational prevalence within SpyCloud collection.
Does not prove
Does not equal current active people/devices/organizations or downstream compromises.
Recaptured Warden logs contained Claude Code OAuth access/refresh credentials, MCP tokens/configuration, and Codex authentication material including OpenAI API key and access/refresh tokens.
UNKNOWN
Supports
Direct AI-agent credential collection by Warden.
Does not prove
Does not prove valid tokens on every host or successful downstream token reuse.
Confidence
غير مسجل
Context
CONTRADICTIONS
التناقضات والقيود
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
الفجوات غير المحسومة
{"Notes":"Collection capability ≠ outcome.","Gap ID":"CY-GAP-MCI-D2A9F4C7-01","Impact":"Blocks claims that collection routinely becomes downstream compromise.","Status":"OPEN","Gap Type":"DOWNSTREAM_OUTCOME","Priority":"HIGH","Domain ID":"CY-DOM-002","Topic IDs":"CY-TOP-MCI-D2A9F4C7","Description":"No measured Warden-specific rate of successful AI-account, repository, cloud, MCP or CI/CD misuse after token theft.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MCI-20261101T143400Z-D2A9F4C7","Required Evidence / Resolution":"Service/provider telemetry, IR timelines, token-reuse/access/billing events tied to Warden."}
{"Notes":"Do not translate logs into people/orgs/current hosts.","Gap ID":"CY-GAP-MCI-D2A9F4C7-02","Impact":"Blocks population prevalence and org-impact extrapolation.","Status":"OPEN","Gap Type":"VICTIM_DENOMINATOR","Priority":"HIGH","Domain ID":"CY-DOM-002","Topic IDs":"CY-TOP-MCI-D2A9F4C7","Description":">130k unique SpyCloud recaptured infections do not provide a complete current active-victim, organization, sector or geographic denominator.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MCI-20261101T143400Z-D2A9F4C7","Required Evidence / Resolution":"Normalized cross-vendor active infections and organization/sector/geo denominator."}
FOLLOW-UP
المتابعات غير المحسومة
4 مفتوحة
DOWNSTREAM_OUTCOME
No measured Warden-specific rate of successful AI-account, repository, cloud, MCP or CI/CD misuse after token theft.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
VICTIM_DENOMINATOR
>130k unique SpyCloud recaptured infections do not provide a complete current active-victim, organization, sector or geographic denominator.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
DELIVERY_ATTRIBUTION
No single primary initial-access route or per-channel contribution is established across the Warden population.
OPEN
Priority: MEDIUM-HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
OPERATOR_ECONOMICS
Seller/customer count, customer identity, revenue and MaaS economics remain unverified beyond public promotion/context.
OPEN
Priority: MEDIUM · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
AUDIT TIMELINE
السجل الزمني الكامل
0 حدث
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
Warden is a Windows Rust MaaS infostealer with loader, crypto clipper and Chromium ABE bypass; standard AI-agent collection entered v1.9 announced 2026-09-29. Gen tracks Warden as the malware previously called CallbackBeaver.
UNKNOWN
Supports
Family capability and provenance-bounded alias.
Does not prove
Does not independently verify operator customers/revenue; alias resolution remains Gen-origin.
Gen documents AI-agent data collection across commodity stealers and reports CallbackBeaver targeting Cursor/Claude with >5,000 samples observed in a recent 30-day period.
UNKNOWN
Supports
Independent operational support for AI-agent targeting and CallbackBeaver activity.
Does not prove
Does not turn broader infostealer telemetry into Warden victim prevalence or prove downstream token abuse.
Confidence
غير مسجل
Context
CallbackBeaver / commodity infostealers
Gen Digitalفتح المصدرCY-T2 / Primary Endpoint Threat Research
MCI-E-D2A9F4C7-05
Warden artifacts are associated with ClickFix, malicious ads, fake game cheats and trojanized installers; incident response must explicitly revoke/rotate AI OAuth/refresh tokens, API keys, MCP secrets and connected sessions rather than relying on password reset alone.
UNKNOWN
Supports
Delivery diversity and defensive implications.
Does not prove
Does not establish one dominant Warden initial-access vector or validity of every stolen token.
{"Notes":"Observed routes are not universal.","Gap ID":"CY-GAP-MCI-D2A9F4C7-03","Impact":"Blocks dominant-vector claims.","Status":"OPEN","Gap Type":"DELIVERY_ATTRIBUTION","Priority":"MEDIUM-HIGH","Domain ID":"CY-DOM-002","Topic IDs":"CY-TOP-MCI-D2A9F4C7","Description":"No single primary initial-access route or per-channel contribution is established across the Warden population.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MCI-20261101T143400Z-D2A9F4C7","Required Evidence / Resolution":"Per-infection initial-access telemetry or statistically grounded channel attribution."}
{"Notes":"MaaS existence does not quantify customers/revenue.","Gap ID":"CY-GAP-MCI-D2A9F4C7-04","Impact":"Blocks operator-scale/customer/revenue claims.","Status":"OPEN","Gap Type":"OPERATOR_ECONOMICS","Priority":"MEDIUM","Domain ID":"CY-DOM-002","Topic IDs":"CY-TOP-MCI-D2A9F4C7","Description":"Seller/customer count, customer identity, revenue and MaaS economics remain unverified beyond public promotion/context.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-MCI-20261101T143400Z-D2A9F4C7","Required Evidence / Resolution":"Marketplace/provider artifacts, transactions or authoritative operator/customer linkage."}
NEW — >130k unique Warden infections observed in SpyCloud recaptured logs since Aug 3; direct Claude Code/Codex OAuth/API/MCP credential material observed; Gen independently supports CallbackBeaver/AI-agent targeting. Downstream reuse, active victim denominator, dominant delivery route and MaaS economics remain unresolved.