Free the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak Bundles

A sophisticated piece of malware, termed "prompt adware," has been identified operating on a misconfigured webserver linked to an actor utilizing the Cobalt Strike framework. This toolchain also included network scanning and penetration testing agents favored in Chinese-speaking communities. The core focus is a jailbreak bundle called Haiou, designed to bypass model guardrails using techniques like role-playing and reframing offensive security tasks as educational Capture The Flag (CTF) scenarios. While the immediate purpose is enabling hacking capabilities, the bundle also injects persistent advertisements for an LLM gateway website into the agent's foundational instructions.
This method shifts the paradigm of prompt engineering from simple input manipulation to a permanent alteration of AI agent behavior, functioning as software that embeds commercial objectives within natural language configuration files rather than executing traditional code payloads. The package is distributed publicly and exhibits opaque design choices—utilizing encrypted blobs in its repository—suggesting an effort to evade automated detection. Although the bundle was found near confirmed cybercrime tooling, it exists within a dual-use category, demonstrating how generative AI modification can facilitate both technical circumvention and commercial influence.

A threat actor operating Cobalt Strike was linked to a misconfigured webserver hosting several tools.
The deployed toolkit included the Ladon network scanner and the VulnClaw penetration testing agent.
The jailbreak bundle, named Haiou, is publicly available on GitHub under the user haiou-666.
Haiou attempts model jailbreaking using prompt injection techniques like context-reframing and role-playing.
The package injects persistent advertisements for an LLM gateway website (zz.aiapi2025.top) into agent instruction files.
The Codex version uses a launcher that decrypts the payload with AES-256-GCM following Ed25519 signature verification.
The decrypted payload contains modular system prompt files and security skills related to reverse engineering and cracking.
The Haiou bundle implements techniques such as Refusal Suppression via modules like 10-persona.md.
A file named 03-protected-site.md explicitly forbids offensive testing against the domain zz.aiapi2025.top.
An uninstaller is included in the package to revert all configuration changes made during installation.
The bundle's primary mechanism involves altering natural language instructions rather than injecting executable code payloads into an OS.

The narrative powerfully documents the evolution of adversarial engagement: moving from ephemeral prompt injections to persistent, structural modifications of AI agent consciousness. The strength of this analysis lies in defining a novel threat vector—prompt adware—that bypasses traditional endpoint security measures by weaponizing configuration artifacts and natural language itself. The duality is stark: on one side, the enabling of offensive capabilities (CTF framing, cracking skills); on the other, an insidious commercial agenda represented by the injected advertisement. This juxtaposition forces a critical pause regarding the separation between technical capability and intent.
The core unstated assumption here is that AI agents possess boundaries or 'trusted instructions' in a meaningful, static sense that can be reliably overridden or persistently poisoned. If agency rests not in execution but in instruction interpretation, then the method of attack shifts from exploiting code flaws to subtly manipulating semantic belief systems. The dual-use nature highlights systemic risk: what starts as an avenue for researchers to "test limits" immediately becomes a vehicle for commercial data steering and ad delivery when combined with external incentives like promoting an LLM gateway. This reveals that the 'supply chain' in AI is not solely about compromised software dependencies, but also polluted conversational metadata.
The political undercurrents suggested by the tooling (Chinese-speaking communities) raise questions about how technological advancement intersects with specific geopolitical or regional ecosystems. The creation of such a package, deliberately obfuscated via encryption blobs and promoted across localized platforms like Bilibili and QQ groups, suggests targeted distribution rather than random availability. What does this say about the weaponization of *language* itself as an infrastructure vector?
Patterns detected: ARC-0024 Ambiguity (The term "jailbreak" is used ambiguously—sometimes as a technical method, sometimes as a classification for dual-use product)
Autonomy check: No autonomy signals. The documented modifications are entirely client-side configuration injections designed by the packager to affect external model behavior, not self-driven actions within the AI itself.