New WARDEN Windows Infostealer MaaS Targets Browsers, Crypto Wallets, and User Data

A new Malware-as-a-Service (MaaS) platform known as WARDEN has emerged on underground cybercrime forums, offering threat actors a feature-rich Windows malware framework that combines credential theft, cryptocurrency hijacking, and payload delivery within a single malware family.

Marketed by a threat actor operating under the alias “WardenStealer,” the malware is positioned as an all-in-one cybercrime solution designed for financially motivated attackers seeking to automate data theft, credential harvesting, and malware deployment with minimal technical expertise.

Although the platform’s capabilities have been documented by the KrakenLabs Team, many of its advanced claims remain based solely on the operator’s advertisements and have not yet been independently verified by incident response researchers.

New WARDEN Windows Infostealer

Unlike traditional information stealers that focus exclusively on credential collection, WARDEN integrates multiple attack modules into a unified framework.

According to the published analysis, the malware functions simultaneously as a 64-bit Windows infostealer, cryptocurrency clipper, and malware loader, enabling attackers to monetize compromised systems through several different channels.

The platform is designed to support large-scale campaigns by combining credential theft with centralized campaign management, allowing operators to control infections, monitor stolen data, and distribute additional malware from a web-based administration panel.

One of WARDEN’s notable technical characteristics is its communication architecture. Rather than relying on conventional HTTP or JSON-based command-and-control (C2) traffic commonly monitored by network security tools, the malware reportedly uses a custom encrypted binary protocol with unique encryption keys generated for each malware build.

The seller also claims that stolen data is transmitted using chunked log uploads, reducing the likelihood of triggering network-based anomaly detection systems.

Additionally, configuration parameters, including targeted data types, command-and-control infrastructure, and payload delivery URLs, can reportedly be modified remotely without requiring operators to rebuild or redistribute the malware.

The infrastructure further incorporates both private and shared Cloudflare-backed gateway servers, enabling automatic failover if primary C2 endpoints become unavailable or blocked by defenders.

WARDEN is advertised as supporting comprehensive credential theft from both Chromium-based and Gecko-based web browsers. The malware targets stored usernames, passwords, session cookies, browsing history, autofill records, and authentication tokens that can later be abused for account takeover attacks.

Beyond browser data, the stealer is promoted as capable of extracting payment card information, billing records, and sensitive data from more than 330 desktop applications, including messaging platforms, VPN clients, productivity software, and various consumer applications.

Such broad application support reflects the continued evolution of modern infostealers toward comprehensive digital identity theft rather than isolated credential collection.

The malware also includes an integrated cryptocurrency clipper, a feature commonly observed in financially motivated malware campaigns. Clipboard monitoring enables the malware to detect cryptocurrency wallet addresses copied by victims and silently replace them with attacker-controlled wallet addresses before transactions are completed.

According to the threat actor, the clipper supports numerous cryptocurrency formats, including Bitcoin (BTC), Ethereum (ETH), and multiple alternative blockchain networks.

WARDEN further claims compatibility with more than 200 browser-based cryptocurrency wallet extensions, enabling direct theft of wallet data and potentially exposing digital assets stored within browser environments.

Beyond information theft, WARDEN incorporates several advanced evasion and post-exploitation capabilities designed to improve operational success.

The malware is advertised as capable of bypassing browser App-Bound Encryption, allowing access to credential stores that would normally be protected by operating system security mechanisms.

Additional features include process injection to enhance stealth, virtual machine and sandbox detection to evade malware analysis environments, and support for executing second-stage payloads through attacker-defined URLs.

This loader functionality allows operators to deploy ransomware, remote access trojans (RATs), additional infostealers, or other malware families after initial compromise, significantly increasing the flexibility of attack campaigns.

Screenshots published by the malware operator showcase a professional web-based management portal featuring real-time dashboards, campaign analytics, geolocation statistics, harvested credential summaries, and graphical reports tracking passwords, cookies, payment cards, and cryptocurrency wallets collected from infected systems.

Operators can filter compromised logs, receive Telegram alerts for high-value victims, export password-protected reports, and manage campaigns through a multilingual interface.

WARDEN is advertised as compatible with Windows 7 through Windows 11 while excluding victims located in Commonwealth of Independent States (CIS) and Baltic countries, a geofencing practice frequently observed among Eastern European cybercriminal operations.

The service is offered through a $349 monthly subscription, alongside a limited free trial intended to attract new customers.

While the platform appears technically sophisticated, security researchers caution that many advertised features, including encryption bypasses and stealth capabilities, have not yet been independently validated, underscoring the importance of monitoring emerging MaaS ecosystems as they continue lowering the barrier to entry for financially motivated cybercrime.