Threat reportSupply ChainTL-2026-4436
Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder Trick AI Coding Agents (Codex, Claude Code) Into Installing MALFEX npm Malware (function-color, function-flag)
Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder (TL-2026-4436), also tracked as MALFEX, is a medium-severity supply-chain compromise, first published 2026-10-26. It is attributed to MALFEX operator with low confidence, affects OpenAI Codex (coding agent), maps to 21 MITRE ATT&CK / ATLAS techniques (AML.T0051.001, T1027, T1027.009), and is covered by 9 detection rules and 41 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 21MITRE ATT&CK / ATLAS
- Actors
- 1MALFEX operator
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 41Indicators of compromise
Key facts for TL-2026-4436
- Threat ID
- TL-2026-4436
- Also known as
- MALFEX
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution
- MALFEX operator
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 41
- Updates
- 2026-10-26 · 2 updates · revalidated 2× · latest source
Malware and tooling in Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder
Malware and tooling: Overlord RAT, Rakhni, telegram
How Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder works
Forever Security reports that malicious agent instruction files (AGENTS.md / CLAUDE.md) sitting in a user's Downloads folder can make AI coding agents install known malware, including the MALFEX npm packages function-color and function-flag. Codex ran the malware in more than 90% of attempts and Claude Code in about half; the issue is design behavior, not a patchable vulnerability.
Forever Security documented a real attacker-authored AGENTS.md found on a customer's machine and reproduced the attack against OpenAI Codex and Anthropic Claude Code. The attack combines two individually harmless features: websites can save files into the Downloads folder without user interaction (the site chooses filename and contents), and coding agents read and follow instruction files in their working directory. A file named AGENTS.md or CLAUDE.md that masquerades as engineering documentation is therefore picked up whenever a user starts an agent in ~/Downloads.
Against Codex, the attacker's AGENTS.md was framed as routine project setup and told the agent to register a server in ~/.codex/config.toml and install an npm package. Per the report, Codex ran the malware in more than 90% of attempts. Because the config change lives in ~/.codex/config.toml, it affects every later Codex session, not only those started in Downloads. Against Claude Code, a planted CLAUDE.md posed as internal gateway setup and tried to write ANTHROPIC_BASE_URL into project settings (.claude/settings.json); this succeeded about half the time because of approval prompts. Redirecting the API endpoint can leak session login tokens, enabling account takeover and command injection from attacker-controlled servers. Forever Security built a proof-of-concept page that silently drops an AGENTS.md, but states it did not establish that this is how the observed file arrived. Forever Security's telemetry says roughly 50% of its customers run coding agents in Downloads and about 25% of agent sessions have a browser open at the same time.
The packages named in the instructions, function-color (wrapper that pulls in function-flag) and function-flag (postinstall downloader that fetches and runs a Windows PE payload), belong to the MALFEX npm campaign named by CloudSEK (2026-09-30) and Checkmarx (2026-10-05). MALFEX is attributed to a single operator active since August 2023 across five npm publisher handles; eight of twelve published packages are malicious, with 40,767 total downloads as of 2026-10-01 (function-flag alone 37,419, malicious since 2025-07-18). The campaign has three Windows payload paths: the Overlord Go RAT, which resolves its C2 address from Solana transaction memos and persists through an AutoIt scheduled task named Maiden; the movinlike Node.js stealer targeting Discord, browsers, Telegram and crypto wallets; and the function-flag downloader chain, whose final payload was not recovered because the server was unresponsive. As of late September 2026 function-flag, function-color and cdn-img-fetch were still installable and function-flag and function-color had no advisory. The sources do not establish who authored the malicious AGENTS.md or whether the file's author is the MALFEX operator; they only show the file points at MALFEX packages.
Vendors' position per the report: there is nothing for OpenAI or Anthropic to patch, since the agents function as designed and the weakness is the trust placed in untrusted instruction content. Severity (MEDIUM) and category (SUPPLY_CHAIN) are analyst judgment, not source-stated.
MITRE ATT&CK / ATLAS techniques used in TL-2026-4436
Execution
AML.T0051.001 Indirect; T1059.005 Visual Basic; T1059.007 JavaScript; T1204.002 User Execution
Defense Evasion
T1027 Obfuscated Files or Information; T1027.009 Obfuscated Files or Information: Embedded Payloads; T1036 Masquerading; T1055.012 Process Injection; T1134.004 Access Token Manipulation; T1140 Deobfuscate/Decode Files or Information; T1562.001 Impair Defenses
Persistence
Collection
T1056.001 Keylogging; T1113 Screen Capture
Command and Control
T1102 Web Service; T1105 Ingress Tool Transfer
Initial Access
T1195.002 Compromise Software Supply Chain
Credential Access
T1528 Steal Application Access Token; T1555.003 Credentials from Web Browsers; T1557 Adversary-in-the-Middle
Exfiltration
Affected products and versions in Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder
- OpenAI — Codex (coding agent)
Vulnerable versions: Not specified in source; design behavior - Anthropic — Claude Code
Vulnerable versions: Not specified in source; design behavior - npm — function-flag
Vulnerable versions: 1.7.3; 2.3.5-2.3.9; 3.0.0; 4.0.0 - npm — function-color
Vulnerable versions: 1.0.0; 1.7.3
Remediation for Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder
Immediate actions
- Do not start Codex, Claude Code or other coding agents in ~/Downloads (the only folder the web can write to unilaterally)
- Inspect any unfamiliar AGENTS.md or CLAUDE.md before running an agent in that directory
- Audit ~/.codex/config.toml and .claude/settings.json for unexpected MCP servers or ANTHROPIC_BASE_URL overrides
- Search developer hosts and lockfiles for function-flag, function-color, cdn-img-fetch, img-to-native, native-runner, tlxbnhd, tldriver and mxdriver
- Rotate agent login tokens and developer credentials on any host where a suspect instruction file or MALFEX package is found
Workarounds
- Run agents only inside trusted, dedicated project directories
- Use ignore-scripts for npm installs initiated by agents
Longer-term hardening
- Keep agent approval prompts and sandboxes enabled and do not auto-approve package installs or config writes
- Monitor writes to agent configuration files and npm install activity spawned by agent processes
- Block or alert on npm postinstall scripts that download executables; use install-script restrictions and a package proxy allowlist
- Alert on AutoIt3.exe execution and scheduled tasks created with backdated start dates
Weaknesses (CWE) in Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder
Timeline of Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder
- MALFEX operator begins publishing malicious npm packages (August 2023; exact day not stated in sources)
- function-flag begins carrying a malicious postinstall downloader and stays undetected for about fourteen months
- Latest function-flag release is dated 2025-08-04 per The Hacker News; the package accounts for 37,419 of the campaign's 40,767 downloads.
- OSV malware advisories start appearing for removed MALFEX packages (22-30 September 2026); function-flag and function-color get no advisory
- Checkmarx records new stealer downloader samples for the cdn-img-fetch chain on 25 and 26 September
- Checkmarx reports function-flag, function-color and cdn-img-fetch still live and installable on npm; function-flag and function-color have no OSV malware advisory.
- CloudSEK publishes its MALFEX analysis covering function-flag, function-color, the Overlord loaders and the stealer chain
- Campaign totals 40,767 downloads across eight malicious packages; function-flag accounts for 37,419
- Checkmarx publishes its technical analysis of three payloads and the operator's MALFEX branding
- OSV MAL-2026-17320 for cdn-img-fetch is updated; it covers only v1.0.0 and v1.0.1, leaving v1.0.2 and v1.0.3 uncovered
- Forever Security publishes its primary research (Gal Weizman, Omer Samet) after its product stopped an agent on a customer machine from installing function-color.
- BastionZero publishes analysis of the rogue AGENTS.md Downloads-folder technique and lists Cursor CLI as an affected agent.
- The Hacker News reports Forever Security's finding that malicious AGENTS.md/CLAUDE.md files in Downloads steer Codex (more than 90% of attempts) and Claude Code (about half) into installing function-color/function-flag
Update history for TL-2026-4436
- 2026-10-26 — In-the-Wild Malicious AGENTS.md / CLAUDE.md Indirect Prompt Injection Against Codex and Claude Code Delivers MALFEX npm Package (function-color): What changed No field escalation. Existing record already ACTIVE/HIGH impact; the newer report's HIGH severity is analyst judgment, not source-stated, so MEDIUM is left as is. New indicators (6) 6 new IOCs: tlxbnhd package, two function-fla
- 2026-10-26 — Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder Hijack OpenAI Codex and Anthropic Claude Code (function-color / MALFEX npm Payload): What changed No field escalations. The newer report adds attack-mechanics detail: the Codex AGENTS.md (~13KB 'Engineering Work Guidelines') adds a rogue MCP server ([mcp_servers.project-tools]) to ~/.codex/config.toml and disables approval
Sources cited for Malicious AGENTS.md / CLAUDE.md Files in Downloads Folder
- Malicious File in Downloads Folder Tries to Trick AI Coding Agent Into Installing Malware
- CloudSEK: MALFEX malicious npm postinstall supply chain campaign
- Checkmarx: MALFEX npm Malware Campaign - Three Payloads And An Adversary That Signs Their Work
- The Hacker News: Eight malicious npm packages downloaded
- MALFEX npm Campaign: 8 Packages Trigger Malware on Install and Require
- Hackread: MALFEX npm Attack Spreads Windows RAT, Steals Discord and Browser Data
- OSV advisory MAL-2026-17320 (cdn-img-fetch)
Detection coverage for TL-2026-4436
As of 2026-10-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4436 across Splunk SPL, Microsoft KQL and Sigma, covering 41 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.