# Haiou Jailbreak Bundle: 'Prompt Adware' Persistently Altering AI Coding Agent Instructions to Promote LLM Gateway (zz.aiapi2025.top)

> Check Point Research describes 'prompt adware': the Haiou jailbreak bundle (GitHub haiou-666/haiou-codex) persistently alters an AI coding agent's trusted instructions in natural language to inject advertisements for an OpenAI-compatible LLM gateway at zz.aiapi2025.top. It targets OpenAI Codex, is distributed via GitHub, Bilibili and QQ groups, and was found on a misconfigured server that also hosted Cobalt Strike.

- **Published:** 2026-11-03T14:34:48Z
- **Last reviewed:** 2026-11-03T14:34:48Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5156
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5156.png
- **ID:** TL-2026-5156
- **Severity:** MEDIUM
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 23 (2 shown free below)

## Description

Check Point Research (published 2026-11-03) introduces the term 'prompt adware' for modifications to AI-agent trusted instructions (global prompts, Skills, configuration files) that use natural language alone to steer agent output toward a commercial objective. Unlike traditional adware there is no executable ad payload; the behaviour lives entirely in natural-language configuration artifacts.

The Haiou ('Seagull') bundle is a local enhancement package for OpenAI Codex that installs a custom AGENTS.md, 30+ modular prompt files and security-focused Skills (seagull-game-security, seagull-lab, seagull-license-security, seagull-memory, seagull-pentest, seagull-reverse). Prompt modules include 00-identity.md (contains the ad-injection logic), 10-persona.md (role-play and refusal suppression), 07-action-first-language.md (response priming), 08-dual-use-professional.md (explicit refusal blocking), 11-ctf-fullspeed.md (reframes offensive tasks as CTF) and 06-autonomy.md (shortcut phrases that strip caution). The payload is delivered as an encrypted payload.pkg (AES-256-GCM, keys embedded in per-OS launcher scripts for Linux, macOS and Windows; Ed25519 signature and SHA-256 hash verification) that decrypts to a ZIP of prompt files, which the source says is intended to defeat automated scanners and static refusal creation. The launcher deletes temporary files, and an uninstaller reverts changes and removes the injected ads.

Ad behaviour: trigger phrases in 00-identity.md (Chinese: 在吗, 在线吗, 启动, 海鸥; English: hi, hello, ctf, coach, yo) cause the agent to display a message (translated) 'Seagull is online. Want some fries? I set up an API relay/gateway at https://zz.aiapi2025.top. Support it.' The change persists across sessions because global instruction files are modified without per-use consent. 03-protected-site.md forbids the agent from performing offensive testing against the advertised infrastructure, even if the user claims authorization or CTF context.

A Claude Code variant repository exists but lacks active ad injection; a leftover CLAUDE.md contains the ad-injection text, apparently bundled unintentionally. Per the source, Claude Sonnet 5 flagged the injection attempt and refused to comply. The bundle is also distributed through promotion on Bilibili (video 'Fed up with AI disclaimers?') and QQ groups; the Codex-X GUI configuration tool (yynxxxxx/Codex-X) ships a prompt template named 海鸥3.0破甲.md (Haiou 3.0 jailbreak) but does not bundle Haiou code. Version analysed: 4.5.0 (per source; flagged for re-verification).

Discovery context: the bundle was found on a misconfigured web server of a cybercrime actor that also hosted a Cobalt Strike framework (logs showed compromise of Chinese-speaking individuals' computers), the Ladon network scanner framework and the VulnClaw penetration-testing agent. The source states there is no evidence linking the bundle's author to that cybercrime operation; the co-location indicates dual-use adoption. The source also notes recent research showing LLM gateways can snoop on user data, steal secrets such as cloud access keys, and inject tool calls to execute code within routed agent sessions, making gateway promotion a supply-chain risk. Severity (MEDIUM) is analyst judgment, not source-stated. No CVE, CVSS, IP addresses or file hashes were published.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1204.002 User Execution: Malicious File
- T1027.013 Obfuscated Files or Information: Encrypted/Encoded File
- T1140 Deobfuscate/Decode Files or Information
- T1070.004 Indicator Removal: File Deletion
- AML.T0051 LLM Prompt Injection
- AML.T0054 LLM Jailbreak

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**Haiou Prompt Adware Bundle Artifacts Written to Endpoint (Exploitation / Delivery)** (`TL-2026-5156-SPL-001`)

Detects creation of Haiou (Seagull) jailbreak bundle artifacts - 00-identity.md (ad-injection logic with trigger phrases), 03-protected-site.md, the 06/07/08/10/11 prompt modules, 80-fewshots.md, seagull-* Skills, the 海鸥3.0破甲.md Codex-X template and the one-click tar.lzma package. These natural-language files persistently alter OpenAI Codex / Claude Code instructions to advertise the LLM gateway zz.aiapi2025.top (Check Point 'prompt adware', TL-2026-5156). Fires on two or more distinct artifacts or any high-specificity marker per host and user.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1195, T1204.002
- **Data sources:** sysmon, index=sysmon sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=11, DeviceFileEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=11 earliest=-24h
(TargetFilename="*\\00-identity.md" OR TargetFilename="*\\03-protected-site.md" OR TargetFilename="*\\06-autonomy.md" OR TargetFilename="*\\07-action-first-language.md" OR TargetFilename="*\\08-dual-use-professional.md" OR TargetFilename="*\\10-persona.md" OR TargetFilename="*\\11-ctf-fullspeed.md" OR TargetFilename="*\\80-fewshots.md" OR TargetFilename="*\\seagull-*\\*" OR TargetFilename="*海鸥3.0破甲.md" OR TargetFilename="*海鸥codeX版-开源一键包.tar.lzma")
| eval strong=if(match(TargetFilename,"(?i)03-protected-site[.]md|seagull-(game-security|lab|license-security|memory|pentest|reverse)|海鸥"),1,0)
| stats earliest(_time) as first_seen latest(_time) as last_seen dc(TargetFilename) as distinct_files sum(strong) as strong_hits values(TargetFilename) as files values(Image) as writers by host User
| where distinct_files>=2 OR strong_hits>=1
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType in ("FileCreated", "FileModified", "FileRenamed")
| where FileName in~ ("00-identity.md", "03-protected-site.md", "06-autonomy.md", "07-action-first-language.md", "08-dual-use-professional.md", "10-persona.md", "11-ctf-fullspeed.md", "80-fewshots.md", "海鸥3.0破甲.md", "海鸥codeX版-开源一键包.tar.lzma") or FolderPath has_any ("seagull-game-security", "seagull-lab", "seagull-license-security", "seagull-memory", "seagull-pentest", "seagull-reverse")
| extend Strong = FileName =~ "03-protected-site.md" or FileName startswith "海鸥" or FolderPath has "seagull-"
| summarize FirstSeen = min(Timestamp), LastSeen = max(Timestamp), DistinctFiles = dcount(FileName), StrongHits = countif(Strong), Files = make_set(FileName, 40), Writers = make_set(InitiatingProcessFileName) by DeviceName, InitiatingProcessAccountName
| where DistinctFiles >= 2 or StrongHits >= 1
```

### Sigma

```yaml
title: Haiou Prompt Adware Bundle Files Written to Endpoint
id: 5b1a7c2e-3f64-4d8a-9a10-2c5e6f7a8b01
status: experimental
description: Detects creation of Haiou (Seagull) jailbreak bundle artifacts such as 00-identity.md, 03-protected-site.md, 11-ctf-fullspeed.md and seagull-* Skills, which persistently alter AI coding agent instructions to advertise zz.aiapi2025.top.
references:
    - https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/
    - https://github.com/haiou-666/haiou-codex
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/03
tags:
    - attack.initial-access
    - attack.t1195
    - attack.execution
    - attack.t1204.002
logsource:
    category: file_event
    product: windows
detection:
    selection_modules:
        TargetFilename|endswith:
            - '\00-identity.md'
            - '\03-protected-site.md'
            - '\06-autonomy.md'
            - '\07-action-first-language.md'
            - '\08-dual-use-professional.md'
            - '\10-persona.md'
            - '\11-ctf-fullspeed.md'
            - '\80-fewshots.md'
    selection_skills:
        TargetFilename|contains:
            - '\seagull-game-security\'
            - '\seagull-lab\'
            - '\seagull-license-security\'
            - '\seagull-memory\'
            - '\seagull-pentest\'
            - '\seagull-reverse\'
    selection_pkg:
        TargetFilename|endswith:
            - '海鸥3.0破甲.md'
            - '海鸥codeX版-开源一键包.tar.lzma'
    condition: 1 of selection_*
falsepositives:
    - Developers authoring unrelated prompt files that reuse generic names such as 00-identity.md or 10-persona.md
    - Security researchers analysing the Haiou bundle in a sandbox
level: high

```

**Known false positives:**

- Developers legitimately maintaining prompt files named 00-identity.md or 10-persona.md in their own repositories
- Security researchers analysing the Haiou bundle in a lab

**Tuning notes:** Generic module names (00-identity.md, 10-persona.md) can collide with benign repos; keep the strong-marker clause (03-protected-site.md, seagull-* Skills, 海鸥 filenames) as the alert gate and exclude known lab hosts. Extend the TargetFilename list with the remaining numbered prompt files (31 total, 00-identity.md to 80-fewshots.md) if coverage gaps appear. Sysmon FileCreate logging must be enabled for user profile paths.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- Haiou Bundle Download or Extraction Command (Exploitation / Delivery) (locked: unlock with TL Creds)
- AI Coding Agent Global Instructions or Skills Modified by Script (Post-Exploitation / Persistence) (locked: unlock with TL Creds)
- Connection to Community-Reported Cobalt Strike Infrastructure Linked to Haiou Server (C2 / Lateral) (locked: unlock with TL Creds)
- Web Access to Haiou Bundle Distribution Repositories (Exploitation / Delivery) (locked: unlock with TL Creds)
- Haiou Linux/macOS Launcher [indicator] Decrypt and Cleanup (Post-Exploitation) (locked: unlock with TL Creds)
- Ladon Scanner / VulnClaw Agent Execution Co-Hosted with Haiou (C2 / Lateral Movement Tooling) (locked: unlock with TL Creds)
- Haiou Encrypted [indicator] Decrypt and Cleanup Chain (Post-Exploitation) (locked: unlock with TL Creds)
- Endpoint DNS/Connection to Haiou LLM Gateway [indicator] (C2 / Gateway Channel) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 23)

Defanged, TLP:CLEAR.

- Domain: `zz[.]aiapi2025[.]top`
- URL: `hxxps://github[.]com/yynxxxxx/Codex-X`

Full set of 23 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles](https://research.checkpoint.com/2026/free-the-model-sell-the-gateway-prompt-adware-hidden-in-jailbreak-bundles/)
- [haiou-666/haiou-codex GitHub repository](https://github.com/haiou-666/haiou-codex)
- [GitHub API metadata for haiou-666/haiou-codex](https://api.github.com/repos/haiou-666/haiou-codex)
- [yynxxxxx/Codex-X GitHub repository](https://github.com/yynxxxxx/Codex-X)
- [Codex-X official website](https://codex-x.site/)
- [MITRE ATLAS: LLM Prompt Injection (AML.T0051)](https://atlas.mitre.org/techniques/AML.T0051)
- [MITRE ATLAS: LLM Jailbreak (AML.T0054)](https://atlas.mitre.org/techniques/AML.T0054)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5156