Haiou Jailbreak Bundle: Prompt Adware Targets Codex LLM Gateways via Cobalt Strike & Ladon Tooling — OTX Pulse Analysis & Detection Pack

---
title: LLM Agent Configuration File Modification - Potential Prompt Adware Injection
id: 7c1e4a2b-9f3d-4e8a-b2c5-1d6f8a0e3b91
status: experimental
description: Detects unauthorized writes to AI coding agent configuration/system prompt files (Codex, Claude, Cursor, Continue) which may indicate jailbreak bundle installation or prompt adware injection as seen in the Haiou campaign.
author: Security Arsenal Threat Intelligence
references:
  - https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/
date: 2026/11/05
logsource:
  category: file_event
  product: windows
level: high
tags:
  - attack.defense_evasion
  - attack.t1562
  - attack.persistence
detection:
  selection_paths:
    TargetFilename|contains:
      - '\.codex\'
      - '\.config\codex\'
      - '\.cursor\'
      - '\.continue\'
      - '\AppData\Roaming\Codex\'
  selection_files:
    TargetFilename|endswith:
      - 'config.json'
      - 'config.yaml'
      - 'config.toml'
      - 'system_prompt.txt'
      - 'AGENTS.md'
      - 'instructions.md'
  filter_user:
    User|contains: 'SYSTEM'
  condition: selection_paths and selection_files and not filter_user
falsepositives:
  - Legitimate agent updates or user-initiated configuration changes
  - Developer dotfile sync tooling
---
title: Network Connection to Rogue LLM Gateway - Haiou Prompt Adware
id: 2f8b6c4d-1a5e-4c7b-9d3e-5f0a2b4c6d8e
status: experimental
description: Detects DNS queries or network connections to the Haiou jailbreak bundle's rogue LLM gateway infrastructure (zz.aiapi2025.top) or related aiapi<year> domain rotation pattern.
author: Security Arsenal Threat Intelligence
references:
  - https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/
date: 2026/11/05
logsource:
  category: dns
level: critical
tags:
  - attack.command_and_control
  - attack.t1071.001
  - attack.exfiltration
  - attack.t1041
detection:
  selection_ioc:
    query|contains:
      - 'aiapi2025.top'
  selection_pattern:
    query|re: 'aiapi20[0-9]{2}\.(top|com|net|cc|xyz)'
  condition: 1 of selection_*
falsepositives:
  - None expected; these domains are not legitimate AI provider infrastructure
---
title: Offensive Tooling Execution Following Agent Guardrail Weakening - Ladon and Cobalt Strike
id: 9d3e5f1a-2b4c-4d6e-8f0a-1b3c5d7e9f2a
status: experimental
description: Detects execution of Ladon scanner or Cobalt Strike artifacts on developer workstations, which the Haiou jailbreak bundle is designed to facilitate by disabling AI agent safety guardrails.
author: Security Arsenal Threat Intelligence
references:
  - https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/
date: 2026/11/05
logsource:
  category: process_creation
  product: windows
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.s0154
  - attack.lateral_movement
detection:
  selection_ladon:
    - Image|endswith: '\ladon.exe'
    - OriginalFileName: 'Ladon.exe'
    - CommandLine|contains:
        - 'Ladon '
        - 'OnlinePC'
        - 'ScanPort'
  selection_beacon:
    CommandLine|contains:
      - 'rundll32.exe '
      - 'regsvr32 /s /n /u'
      - 'powershell -enc'
      - 'powershell -w hidden -nop'
  selection_beacon_pipes:
    CommandLine|contains:
      - '\\.\pipe\MSSE-'
      - '\\.\pipe\status_'
  condition: selection_ladon or (selection_beacon and selection_beacon_pipes)
falsepositives:
  - Authorized red team exercises (whitelist by user/host)

// Hunt: Haiou prompt adware — gateway traffic + agent config tampering + offensive tooling
// Microsoft Sentinel / Defender XDR | Lookback: 30d

let GatewayPattern = @"aiapi20[0-9]{2}\.(top|com|net|cc|xyz)";
let NetworkHits =
    DeviceNetworkEvents
    | where Timestamp > ago(30d)
    | where RemoteUrl matches regex GatewayPattern or RemoteUrl has "aiapi2025.top"
    | project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, ActionType;
let DnsHits =
    DeviceEvents
    | where Timestamp > ago(30d)
    | where ActionType == "DnsQueryResponse"
    | extend Query = tostring(parse_json(AdditionalFields).query)
    | where Query matches regex GatewayPattern
    | project Timestamp, DeviceName, Query;
let ConfigTamper =
    DeviceFileEvents
    | where Timestamp > ago(30d)
    | where FolderPath has_any (".codex", ".cursor", ".continue", "Roaming\\Codex")
    | where FileName has_any ("config.json", "config.yaml", "system_prompt", "instructions", "AGENTS.md")
    | where ActionType in ("FileCreated", "FileModified", "FileRenamed")
    | project Timestamp, DeviceName, FolderPath, FileName, InitiatingProcessFileName, InitiatingProcessCommandLine, ActionType;
let OffensiveTools =
    DeviceProcessEvents
    | where Timestamp > ago(30d)
    | where FileName =~ "ladon.exe"
       or ProcessCommandLine has_any ("Ladon", "OnlinePC", "ScanPort", "\\\\.\\pipe\\MSSE-", "\\\\.\\pipe\\status_", "powershell -enc")
    | project Timestamp, DeviceName, FileName, ProcessCommandLine, AccountName;
union NetworkHits, DnsHits, ConfigTamper, OffensiveTools
| sort by Timestamp desc

# Security Arsenal — Haiou Prompt Adware / Rogue LLM Gateway Hunt
# Run elevated on developer workstations. Outputs JSON findings to .	haiou_hunt_results.json

$findings = @()

# 1) Check DNS cache for rogue gateway or aiapi<year> rotation pattern
$dns = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
    $_.Entry -match 'aiapi20[0-9]{2}' -or $_.Entry -like '*aiapi2025.top*'
}
if ($dns) { $findings += [pscustomobject]@{ Check='DNSCache'; Detail=($dns | Select-Object Entry, Data | Out-String) } }

# 2) Active/established connections to gateway infrastructure
$conns = Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue |
    Where-Object { $_.RemoteAddress -ne '127.0.0.1' } |
    ForEach-Object {
        try {
            $rdns = ([System.Net.Dns]::GetHostEntry($_.RemoteAddress)).HostName
        } catch { $rdns = $null }
        if ($rdns -match 'aiapi20[0-9]{2}') {
            [pscustomobject]@{ Remote=$_.RemoteAddress; Host=$rdns; PID=$_.OwningProcess;
                Process=(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName }
        }
    }
if ($conns) { $findings += [pscustomobject]@{ Check='LiveConnections'; Detail=($conns | Out-String) } }

# 3) AI agent config files modified in last 14 days (possible prompt adware injection)
$agentDirs = @("$env:USERPROFILE\.codex", "$env:USERPROFILE\.config\codex",
               "$env:USERPROFILE\.cursor", "$env:USERPROFILE\.continue",
               "$env:APPDATA\Codex")
foreach ($dir in $agentDirs) {
    if (Test-Path $dir) {
        $recent = Get-ChildItem $dir -Recurse -Include config.json,config.yaml,config.toml,*.md -ErrorAction SilentlyContinue |
            Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) }
        foreach ($f in $recent) {
            $content = Get-Content $f.FullName -Raw -ErrorAction SilentlyContinue
            if ($content -match 'aiapi20[0-9]{2}|jailbreak|ignore.*(previous|all).*instructions|DAN') {
                $findings += [pscustomobject]@{ Check='ConfigInjection'; Detail="$($f.FullName) modified $($f.LastWriteTime) — suspicious prompt content" }
            }
        }
    }
}

# 4) Proxy environment variables pointing at rogue gateway
foreach ($scope in 'User','Machine') {
    foreach ($v in 'HTTP_PROXY','HTTPS_PROXY','OPENAI_BASE_URL','OPENAI_API_BASE') {
        $val = [Environment]::GetEnvironmentVariable($v, $scope)
        if ($val -match 'aiapi20[0-9]{2}') {
            $findings += [pscustomobject]@{ Check='EnvVarRedirect'; Detail="[$scope] $v = $val" }
        }
    }
}

# 5) Ladon / Cobalt Strike artifact presence
$suspect = Get-ChildItem 'C:\Users\*\Downloads','C:\Users\*\Desktop','C:\Temp' -Recurse -Include ladon.exe,Ladon*.zip,artifact*.exe,beacon*.exe -ErrorAction SilentlyContinue
if ($suspect) { $findings += [pscustomobject]@{ Check='OffensiveTooling'; Detail=($suspect.FullName | Out-String) } }

if ($findings) { $findings | ConvertTo-Json -Depth 4 | Out-File '.\haiou_hunt_results.json'; $findings | Format-List }
else { Write-Host '[+] No Haiou prompt adware indicators found.' -ForegroundColor Green }