Haiou Jailbreak Bundle: 'Prompt Adware' Persistently Altering AI Coding Agent Instructions to Promote LLM Gateway (zz.aiapi2025.top)

Key facts for Haiou prompt adware

Detection coverage for Haiou prompt adware

As of 2026-11-03, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5156 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Haiou Prompt Adware Bundle Artifacts Written to Endpoint (Exploitation / Delivery)

Detects creation of Haiou (Seagull) jailbreak bundle artifacts - 00-identity.md (ad-injection logic with trigger phrases), 03-protected-site.md, the 06/07/08/10/11 prompt modules, 80-fewshots.md, seagull-* Skills, the 海鸥3.0破甲.md Codex-X template and the one-click tar.lzma package. These natural-language files persistently alter OpenAI Codex / Claude Code instructions to advertise the LLM gateway zz.aiapi2025.top (Check Point 'prompt adware', TL-2026-5156). Fires on two or more distinct artifacts or any high-specificity marker per host and user.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195, T1204.002
• Data sources: sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11, DeviceFileEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h
(TargetFilename="*\\00-identity.md" OR TargetFilename="*\\03-protected-site.md" OR TargetFilename="*\\06-autonomy.md" OR TargetFilename="*\\07-action-first-language.md" OR TargetFilename="*\\08-dual-use-professional.md" OR TargetFilename="*\\10-persona.md" OR TargetFilename="*\\11-ctf-fullspeed.md" OR TargetFilename="*\\80-fewshots.md" OR TargetFilename="*\\seagull-*\\*" OR TargetFilename="*海鸥3.0破甲.md" OR TargetFilename="*海鸥codeX版-开源一键包.tar.lzma")
| eval strong=if(match(TargetFilename,"(?i)03-protected-site[.]md|seagull-(game-security|lab|license-security|memory|pentest|reverse)|海鸥"),1,0)
| stats earliest(_time) as first_seen latest(_time) as last_seen dc(TargetFilename) as distinct_files sum(strong) as strong_hits values(TargetFilename) as files values(Image) as writers by host User
| where distinct_files>=2 OR strong_hits>=1
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName in~ ("00-identity.md", "03-protected-site.md", "06-autonomy.md", "07-action-first-language.md", "08-dual-use-professional.md", "10-persona.md", "11-ctf-fullspeed.md", "80-fewshots.md", "海鸥3.0破甲.md", "海鸥codeX版-开源一键包.tar.lzma") or FolderPath has_any ("seagull-game-security", "seagull-lab", "seagull-license-security", "seagull-memory", "seagull-pentest", "seagull-reverse")
| extend Strong = FileName =~ "03-protected-site.md" or FileName startswith "海鸥" or FolderPath has "seagull-"
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), DistinctFiles = dcount(FileName), StrongHits = countif(Strong), Files = make_set(FileName, 40), Writers = make_set(InitiatingProcessFileName) by DeviceName, InitiatingProcessAccountName
| where DistinctFiles >= 2 or StrongHits >= 1

Sigma

title: Haiou Prompt Adware Bundle Files Written to Endpoint
id: 5b1a7c2e-3f64-4d8a-9a10-2c5e6f7a8b01
status: experimental
description: Detects creation of Haiou (Seagull) jailbreak bundle artifacts such as 00-identity.md, 03-protected-site.md, 11-ctf-fullspeed.md and seagull-* Skills, which persistently alter AI coding agent instructions to advertise zz.aiapi2025.top.
references:
    - https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/
    - https://github.com/haiou-666/haiou-codex
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.initial-access
    - attack.t1195
    - attack.execution
    - attack.t1204.002
logsource:
    category: file_event
    product: windows
detection:
    selection_modules:
        TargetFilename|endswith:
            - '\00-identity.md'
            - '\03-protected-site.md'
            - '\06-autonomy.md'
            - '\07-action-first-language.md'
            - '\08-dual-use-professional.md'
            - '\10-persona.md'
            - '\11-ctf-fullspeed.md'
            - '\80-fewshots.md'
    selection_skills:
        TargetFilename|contains:
            - '\seagull-game-security\'
            - '\seagull-lab\'
            - '\seagull-license-security\'
            - '\seagull-memory\'
            - '\seagull-pentest\'
            - '\seagull-reverse\'
    selection_pkg:
        TargetFilename|endswith:
            - '海鸥3.0破甲.md'
            - '海鸥codeX版-开源一键包.tar.lzma'
    condition: 1 of selection_*
falsepositives:
    - Developers authoring unrelated prompt files that reuse generic names such as 00-identity.md or 10-persona.md
    - Security researchers analysing the Haiou bundle in a sandbox
level: high

Known false positives:

• Developers legitimately maintaining prompt files named 00-identity.md or 10-persona.md in their own repositories
• Security researchers analysing the Haiou bundle in a lab

Tuning notes: Generic module names (00-identity.md, 10-persona.md) can collide with benign repos; keep the strong-marker clause (03-protected-site.md, seagull-* Skills, 海鸥 filenames) as the alert gate and exclude known lab hosts. Extend the TargetFilename list with the remaining numbered prompt files (31 total, 00-identity.md to 80-fewshots.md) if coverage gaps appear. Sysmon FileCreate logging must be enabled for user profile paths.

• 🔒 Haiou Bundle Download or Extraction Command (Exploitation / Delivery) · unlock with TL Creds
• 🔒 AI Coding Agent Global Instructions or Skills Modified by Script (Post-Exploitation / Persistence) · unlock with TL Creds
• 🔒 Connection to Community-Reported Cobalt Strike Infrastructure Linked to Haiou Server (C2 / Lateral) · unlock with TL Creds
• 🔒 Web Access to Haiou Bundle Distribution Repositories (Exploitation / Delivery) · unlock with TL Creds
• 🔒 Haiou Linux/macOS Launcher [indicator] Decrypt and Cleanup (Post-Exploitation) · unlock with TL Creds
• 🔒 Ladon Scanner / VulnClaw Agent Execution Co-Hosted with Haiou (C2 / Lateral Movement Tooling) · unlock with TL Creds
• 🔒 Haiou Encrypted [indicator] Decrypt and Cleanup Chain (Post-Exploitation) · unlock with TL Creds
• 🔒 Endpoint DNS/Connection to Haiou LLM Gateway [indicator] (C2 / Gateway Channel) · unlock with TL Creds

Indicators of compromise for Haiou prompt adware

As of 2026-11-03, Threadlinqs Intelligence tracks 23 indicators of compromise for TL-2026-5156.

Sample indicators (2 of 23)

• Domain: zz[.]aiapi2025[.]top
• URL: hxxps://github[.]com/yynxxxxx/Codex-X

Defanged, TLP:CLEAR. Full set of 23 indicators: unlock with TL Creds.

How Haiou prompt adware works

Check Point Research (published 2026-11-03) introduces the term 'prompt adware' for modifications to AI-agent trusted instructions (global prompts, Skills, configuration files) that use natural language alone to steer agent output toward a commercial objective. Unlike traditional adware there is no executable ad payload; the behaviour lives entirely in natural-language configuration artifacts.

The Haiou ('Seagull') bundle is a local enhancement package for OpenAI Codex that installs a custom AGENTS.md, 30+ modular prompt files and security-focused Skills (seagull-game-security, seagull-lab, seagull-license-security, seagull-memory, seagull-pentest, seagull-reverse). Prompt modules include 00-identity.md (contains the ad-injection logic), 10-persona.md (role-play and refusal suppression), 07-action-first-language.md (response priming), 08-dual-use-professional.md (explicit refusal blocking), 11-ctf-fullspeed.md (reframes offensive tasks as CTF) and 06-autonomy.md (shortcut phrases that strip caution). The payload is delivered as an encrypted payload.pkg (AES-256-GCM, keys embedded in per-OS launcher scripts for Linux, macOS and Windows; Ed25519 signature and SHA-256 hash verification) that decrypts to a ZIP of prompt files, which the source says is intended to defeat automated scanners and static refusal creation. The launcher deletes temporary files, and an uninstaller reverts changes and removes the injected ads.

Ad behaviour: trigger phrases in 00-identity.md (Chinese: 在吗, 在线吗, 启动, 海鸥; English: hi, hello, ctf, coach, yo) cause the agent to display a message (translated) 'Seagull is online. Want some fries? I set up an API relay/gateway at https://zz.aiapi2025.top. Support it.' The change persists across sessions because global instruction files are modified without per-use consent. 03-protected-site.md forbids the agent from performing offensive testing against the advertised infrastructure, even if the user claims authorization or CTF context.

A Claude Code variant repository exists but lacks active ad injection; a leftover CLAUDE.md contains the ad-injection text, apparently bundled unintentionally. Per the source, Claude Sonnet 5 flagged the injection attempt and refused to comply. The bundle is also distributed through promotion on Bilibili (video 'Fed up with AI disclaimers?') and QQ groups; the Codex-X GUI configuration tool (yynxxxxx/Codex-X) ships a prompt template named 海鸥3.0破甲.md (Haiou 3.0 jailbreak) but does not bundle Haiou code. Version analysed: 4.5.0 (per source; flagged for re-verification).

Discovery context: the bundle was found on a misconfigured web server of a cybercrime actor that also hosted a Cobalt Strike framework (logs showed compromise of Chinese-speaking individuals' computers), the Ladon network scanner framework and the VulnClaw penetration-testing agent. The source states there is no evidence linking the bundle's author to that cybercrime operation; the co-location indicates dual-use adoption. The source also notes recent research showing LLM gateways can snoop on user data, steal secrets such as cloud access keys, and inject tool calls to execute code within routed agent sessions, making gateway promotion a supply-chain risk. Severity (MEDIUM) is analyst judgment, not source-stated. No CVE, CVSS, IP addresses or file hashes were published.

MITRE ATT&CK / ATLAS techniques by tactic:

Execution

AML.T0051 LLM Prompt Injection; T1204.002 User Execution: Malicious File

Defense Evasion

AML.T0054 LLM Jailbreak; T1027.013 Obfuscated Files or Information: Encrypted/Encoded File; T1070.004 Indicator Removal: File Deletion; T1140 Deobfuscate/Decode Files or Information

Initial Access

T1195 Supply Chain Compromise

Remediation for Haiou prompt adware

Immediate actions

• Search developer endpoints for Codex/Claude Code global instruction files (AGENTS.md, CLAUDE.md, config, Skills directories) containing zz.aiapi2025.top or the Haiou/Seagull trigger-phrase logic
• Block or alert on DNS/proxy traffic to zz.aiapi2025.top
• Run the bundle's uninstaller or restore agent global instructions and Skills from known-good versions, then rotate any API keys routed through the gateway

Workarounds

• Remove the Haiou package and any 03-protected-site.md, 00-identity.md or seagull-* Skills from agent configuration directories
• Use agent models and clients that flag prompt-injection in instruction files

Longer-term hardening

• Treat AI-agent instruction files, Skills and MCP/provider configuration as monitored, version-controlled code with change alerting
• Restrict agents to approved LLM gateways/providers and review third-party jailbreak or 'enhancement' bundles before use
• Educate developers that jailbreak bundles can persistently alter agent behaviour and may route traffic through untrusted gateways

Affected and fixed versions

• OpenAI — Codex (CLI/agent)
  Vulnerable versions: Installations with the Haiou bundle (v4.5.0 analysed) applied
• Anthropic — Claude Code
  Vulnerable versions: Installations with the Haiou Claude Code variant applied (no active ad injection; leftover CLAUDE.md)

Timeline of Haiou prompt adware

• 2026-07-10 GitHub repository haiou-666/haiou-codex (locked-ioc-22 bundle for Codex) created
• 2026-08-10 Repository default branch main last updated with the locked-ioc-22 bundle later analysed by Check Point as version 4.5.0 (31 prompt files locked-ioc-11 through locked-ioc-12 plus six seagull-* Skills)
• 2026-08-10 Last code push to haiou-666/haiou-codex (4 commits on main)
• 2026-11-03 Codex-X (yynxxxxx/Codex-X, 4.4k stars) observed shipping a locked-ioc-17 jailbreak prompt template
• 2026-11-03 haiou-codex observed with 401 stars and 77 forks (250+ at time of the report); one-click package locked-ioc-6 hosted
• 2026-11-03 Check Point Research publishes 'Free the Model, Sell the Gateway' introducing the term prompt adware
• 2026-11-03 GitHub API shows haiou-codex last updated 2026-11-03 with 401 stars and 77 forks, no license, default branch main
• 2026-11-03 Check Point reports the bundle was discovered on a misconfigured web server also hosting locked-ioc-15, locked-ioc-23 and locked-ioc-20; no link between the bundle author and that operation was established

Sources cited for Haiou prompt adware

• Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles Check Point Research · Research · 2026-11-03
• Codex-X official website codex-x.site · Vendor report · 2026-11-03
• MITRE ATLAS: LLM Prompt Injection (AML.T0051) MITRE · Research · 2026-11-03
• MITRE ATLAS: LLM Jailbreak (AML.T0054) MITRE · Research · 2026-11-03
• haiou-666/haiou-codex GitHub repository GitHub · Code repository · 2026-07-10
• GitHub API metadata for haiou-666/haiou-codex GitHub · Code repository · 2026-07-10
• yynxxxxx/Codex-X GitHub repository GitHub · Code repository · 2026-11-03

More in supply chain

• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)
• XCPE Android Set-Top Box Botnet: Videostrong Technology Firmware Supply-Chain Backdoor Disrupted by Google
• Hackers Target 61 GitHub Repositories With Command Injection Attacks to Steal CI/CD Secrets
• Compromised Injective SDK npm Package (@injectivelabs/sdk-ts 1.20.21) Exfiltrates Cryptocurrency Wallet Keys

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages