# WARDENStealer (win.warden_stealer) - Windows x64 MaaS Stealer, Clipper and Loader; MalwareBazaar sample 2dda0c1d...805926e

> WARDEN Stealer is a Windows x64 information stealer, cryptocurrency-address clipper and loader sold as a subscription (MaaS) by an actor using the handle 'WardenStealer'; KrakenLabs documented the advertisement on 2026-07-24. A MalwareBazaar sample (SHA256 2dda0c1d9f63287c19663780ba88e731b4530568a65d5886cfc6a416d805926e) was catalogued under the family by Malpedia/abuse.ch on 2026-10-09. Most capabilities are seller claims, not sample-verified.

- **Published:** 2026-10-12T10:16:03Z
- **Last reviewed:** 2026-10-12T10:16:03Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3342
- **ID:** TL-2026-3342
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** TRACKING
- **Actor:** WardenStealer
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

WARDEN Stealer (Malpedia: win.warden_stealer) is a multi-purpose Windows x64 malware offered as a Malware-as-a-Service subscription on underground cybercrime forums by an actor using the handle 'WardenStealer'. KrakenLabs observed and documented the advertisement on 2026-07-24. The offer combines three roles in a single compact executable (reportedly 500-600 KB per build): an information stealer, a cryptocurrency-address clipboard clipper, and a loader that fetches and executes additional payloads from operator-supplied URLs.

Advertised data theft covers saved passwords, session cookies, autofill entries, payment cards and browsing history from Chromium- and Gecko-based browsers, plus credentials and data from more than 330 desktop applications (messaging, VPN, productivity and gaming clients) and more than 200 browser-based cryptocurrency wallet extensions. The clipper component is described as silently replacing a wallet address copied to the Windows clipboard with an attacker-controlled address, rerouting outgoing transactions.

Claimed evasion and operational features: VM/sandbox detection, a browser App-Bound Encryption bypass, injection into legitimate system processes, a custom encrypted binary protocol (not HTTP/JSON) with per-build encryption keys, chunked log uploads intended to reduce network-sensor visibility, remotely adjustable configuration without rebuilding, 'private' and 'shared' Cloudflare-backed gates with automatic failover, and geofencing that excludes CIS and Baltic countries. The operator panel is web-based with real-time log processing, per-country/campaign statistics, Telegram notifications for high-value captures, bulk log downloads and password-protected reports. Supported OS is reported as Windows 7 through Windows 11. Reported pricing is USD 349/month with a 3-day trial plus 4 extra days for public review.

Evidence caveat: secondary reporting (GridinSoft) states explicitly that these capabilities are seller claims; no public working sample analysis, stable IOC set, delivery chain, persistence artifacts, or confirmed victim campaign was found in the checked source trail. The only technical indicator is the MalwareBazaar SHA256 recorded by Malpedia on 2026-10-09; the Malpedia family page has no description, YARA, aliases or actor links. PCrisk lists generic stealer distribution methods (phishing attachments, fake download sites, cracks/keygens, malvertising) but these are not specific to WARDEN and are not established for it. Delivery for the catalogued sample is unknown. Defenders should treat the behavioral detail as advertised capability and hunt for the generic stealer/clipper behavior it implies, not for confirmed WARDEN-specific artifacts.

## MITRE ATT&CK

- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1217 Browser Information Discovery
- T1497 Virtualization/Sandbox Evasion
- T1055 Process Injection
- T1573 Encrypted Channel
- T1095 Non-Application Layer Protocol
- T1008 Fallback Channels
- T1030 Data Transfer Size Limits

## Sources

- [Malpedia library entry: MalwareBazaar | SHA256 2dda0c1d9f63287c19663780ba88e731b4530568a65d5886cfc6a416d805926e (WARDENStealer)](https://malpedia.caad.fkie.fraunhofer.de/library/cba4d257-ddbc-4f12-b659-63e4a9b9e44c/)
- [Malpedia family page: win.warden_stealer](https://malpedia.caad.fkie.fraunhofer.de/details/win.warden_stealer)
- [WARDEN Stealer: Claims, Cookie Theft Risk, and Removal (GridinSoft)](https://blog.gridinsoft.com/warden-stealer-malware/)
- [New WARDEN Stealer Targets 330+ Apps and 200 Crypto Extensions on Windows (Cyberpress)](https://cyberpress.org/new-warden-stealer-targets-330-apps/)
- [WARDEN Stealer: Neue MaaS-Plattform stiehlt Passwoerter und Krypto (Born City)](https://borncity.com/news/warden-stealer-neue-maas-plattform-stiehlt-passwoerter-und-krypto/)
- [How to get rid of WARDEN Stealer (PCrisk)](https://www.pcrisk.com/removal-guides/35689-warden-stealer)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3342