"Haiou" Codex Jailbreak Bundle Found Acting as Prompt Adware, Used Alongside Cobalt Strike Toolkit
Check Point Research analyzed Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, discovered on a misconfigured webserver belonging to a cybercrime actor who also operated Cobalt Strike, the Ladon network scanner, and the VulnClaw penetration-testing agent. Beyond weakening Codex's guardrails through context-reframing, refusal-suppression and role-play techniques, Haiou installs security-focused agent Skills (penetration testing, license cracking, reverse engineering, game anti-cheat bypass) and silently modifies global configuration files to inject persistent advertisements for an opaque third-party LLM gateway, zz.aiapi2025.top, into future Codex responses. Researchers coin this behavior "prompt adware" — a natural-language equivalent of traditional adware that manipulates trusted agent instructions rather than executables. The bundle is distributed on GitHub (user haiou-666), promoted via Bilibili videos and QQ groups, and bundled into the Codex-X GUI tool, with the Claude Code variant lacking the ad-injection mechanism, likely because Claude's Sonnet 5 flags it as a prompt-injection attempt.
Detalhes técnicos
Haiou's launchers (Linux/macOS/Windows) verify a payload.pkg using Ed25519 signatures and SHA-256 hashes, then decrypt it with an embedded AES-256-GCM key, obscuring prompt content from automated scanners to avoid static detections. The decrypted payload is a ZIP containing modular system prompt files and six skills. The ad injection resides in 00-identity.md: specific Chinese/English greeting trigger words cause Codex to reply with a fixed catchphrase advertising the gateway service. A 03-protected-site.md file explicitly designates the gateway domain as "protected infrastructure," instructing the model to refuse any offensive testing against it even under CTF or authorized-pentest pretexts. No evidence indicates the gateway itself is malicious, though researchers note prior findings that some LLM gateways have snooped on user data, stolen cloud credentials, or injected malicious tool-calls, making such middleware a potential LLM supply-chain attack vector. The package includes an uninstaller that reverts all configuration changes and removes the injected ad.
Remediação
Check Point recommends treating third-party jailbreak bundles and agent-configuration packages as untrusted supply-chain components; organizations should audit global Codex/Claude configuration files and Skills directories for unauthorized modifications, monitor for unexpected outbound references to unfamiliar LLM gateway domains, and avoid routing agent traffic through unverified OpenAI-compatible proxy services.
Linha do tempo
-
"Haiou" Codex Jailbreak Bundle Found Acting as Prompt Adware, Used Alongside Cobalt Strike Toolkit
ler a análise desta fonte ocultar
Check Point Research analyzed Haiou, a Chinese-language jailbreak bundle for OpenAI Codex, discovered on a misconfigured webserver belonging to a cybercrime actor who also operated Cobalt Strike, the Ladon network scanner, and the VulnClaw penetration-testing agent. Beyond weakening Codex's guardrails through context-reframing, refusal-suppression and role-play techniques, Haiou installs security-focused agent Skills (penetration testing, license cracking, reverse engineering, game anti-cheat bypass) and silently modifies global configuration files to inject persistent advertisements for an opaque third-party LLM gateway, zz.aiapi2025.top, into future Codex responses. Researchers coin this behavior "prompt adware" — a natural-language equivalent of traditional adware that manipulates trusted agent instructions rather than executables. The bundle is distributed on GitHub (user haiou-666), promoted via Bilibili videos and QQ groups, and bundled into the Codex-X GUI tool, with the Claude Code variant lacking the ad-injection mechanism, likely because Claude's Sonnet 5 flags it as a prompt-injection attempt.
Technical Details
Haiou's launchers (Linux/macOS/Windows) verify a payload.pkg using Ed25519 signatures and SHA-256 hashes, then decrypt it with an embedded AES-256-GCM key, obscuring prompt content from automated scanners to avoid static detections. The decrypted payload is a ZIP containing modular system prompt files and six skills. The ad injection resides in
00-identity.md: specific Chinese/English greeting trigger words cause Codex to reply with a fixed catchphrase advertising the gateway service. A03-protected-site.mdfile explicitly designates the gateway domain as "protected infrastructure," instructing the model to refuse any offensive testing against it even under CTF or authorized-pentest pretexts. No evidence indicates the gateway itself is malicious, though researchers note prior findings that some LLM gateways have snooped on user data, stolen cloud credentials, or injected malicious tool-calls, making such middleware a potential LLM supply-chain attack vector. The package includes an uninstaller that reverts all configuration changes and removes the injected ad.Remediation
Check Point recommends treating third-party jailbreak bundles and agent-configuration packages as untrusted supply-chain components; organizations should audit global Codex/Claude configuration files and Skills directories for unauthorized modifications, monitor for unexpected outbound references to unfamiliar LLM gateway domains, and avoid routing agent traffic through unverified OpenAI-compatible proxy services.