WARDEN stealer advertised: crypto extensions + clipboard address swap
Kraken Security Labs flagged a new underground offer: WARDEN (actor WardenStealer): a Windows x64 stealer, clipper, and loader sold with a control panel (~$349/mo).
Seller claims include Chromium/Gecko credential theft, 200+ cryptocurrency browser extensions, clipboard replacement of BTC/ETH addresses, App-Bound Encryption bypass, and secondary payload delivery.
Kraken notes these are threat-actor marketing claims and have not been independently verified.
369 take
Extension wallets are the advertised target. Treat unknown Windows installs and “free crack” tools as hostile.
Seedless / hardware-unlock wallets raise the bar against seed dump, but clippers still hit any pasted receive address: verify last characters before you send.
Never download “samples” from underground ads.
Sources