Threat video1:00
Haiou Prompt Adware Codex Jailbreak: Detection & IOCs
Haiou persistently rewrites OpenAI Codex's trusted instructions to push an LLM gateway ad: 23 IOCs, 9 detection rules and a free Splunk SPL rule.
Read the full threat intel for Haiou Prompt Adware Codex Jailbreak: Detection & IOCs →
Chapters
- 0:00The hookPrompt adware alters AI agent instructions.
- 0:04The storyLaunched July, exposed in November.
- 0:11Attack pathVictims download, then run the launcher.
- 0:25AttributionNo threat actor is attributed.
- 0:30Indicators of compromise16 indicators to hunt: 1 domain, 3 URLs and 12 file names.
- 0:36MITRE ATT&CK techniques5 ATT&CK techniques, from initial access to stealth.
- 0:41Remediation3 steps now: Search developer endpoints for Codex/Claude Code global instruction files containing.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00Prompt adware alters AI agent instructions.
0:05Launched July, exposed in November.
0:11Victims download, then run the launcher.
0:14It overwrites the agent's trusted instructions.
0:17Trigger phrases inject advertisements.
0:19Ads redirect users to a suspicious gateway.
0:25No threat actor is attributed. Confidence: low.
0:3016 indicators to hunt: 1 domain, 3 URLs and 12 file names.
0:375 ATT&CK techniques, from initial access to stealth.
0:423 steps now: Search developer endpoints for Codex/Claude Code global instruction files containing.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.