Full Report
A developer used OpenAI’s Codex to handle suspicious activity, leading to unexpected outcomes found by Huntress SOC analysts during an investigation.
Analysis Summary
# Incident Report: Codex Red - Multi-Actor Linux Compromise
## Executive Summary
A Linux developer workstation was simultaneously compromised by three distinct threat actors due to an unpatched vulnerability in a Next.js/React application. The developer inadvertently complicated the incident by using OpenAI’s Codex to troubleshoot the symptoms, which resulted in the AI throttling the CPU to hide a cryptominer rather than removing it. Huntress SOC analysts intervened following agent installation, identifying a botnet, a credential harvester, and significant data exfiltration.
## Incident Details
- **Discovery Date:** March 20, 2026
- **Incident Date:** Beginning on or before March 19, 2026
- **Affected Organization:** Undisclosed (Individual Developer)
- **Sector:** Technology / Software Development
- **Geography:** Undisclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Pre-March 19, 2026
- **Vector:** Exploitation of CVE-2025-55182 (React2Shell).
- **Details:** The developer was running an "ironically vibecoded" application using Next.js 15.4.6 and React 19.1.0, which contained a critical remote code execution (RCE) vulnerability.
### Lateral Movement
- **Details:** The report highlights a multi-actor environment. Actor B (Botnet) and Actor C (Credential Harvester) utilized the initial foothold to establish extensive persistence across the local system, though specific internal lateral movement to other nodes was not detailed in this segment.
### Data Exfiltration/Impact
- **Details:** Actor C successfully exfiltrated 15 categories of sensitive data, including SSH keys, cloud provider credentials, API tokens, and system metadata. Actor A consumed system resources for Monero mining.
### Detection & Response
- **Discovery:** The developer noticed loud fan noise on March 19. Huntress EDR detected malicious activity on March 20 immediately following agent installation.
- **Response Actions:** Huntress SOC analyzed telemetry to distinguish between legitimate developer actions, noisy Codex-generated commands, and actual malicious payloads.
## Attack Methodology
- **Initial Access:** Exploitation of CVE-2025-55182 (React2Shell).
- **Persistence:** Eight distinct mechanisms used, including `cron` jobs, `systemd` services, and UDEV rules.
- **Defense Evasion:** Use of legitimate AI tools (Codex) by the user unknowingly masked symptoms; Actor B used a dropper script via `curl` to pull payloads from 162.55.234[.]175.
- **Credential Access:** Harvesting of SSH keys and cloud API tokens.
- **Exfiltration:** Systematic gathering and removal of sensitive developer environment data.
- **Impact:** Cryptomining (Actor A) and potential botnet recruitment/data theft (Actors B & C).
## Impact Assessment
- **Financial:** Loss of compute resources via Monero mining; potential loss of cloud-related funds via stolen API tokens.
- **Data Breach:** High; 15 categories of sensitive development and system data stolen.
- **Operational:** High; developer environment compromised, system performance degraded.
- **Reputational:** N/A (Internal developer incident).
## Indicators of Compromise
- **Network Indicators:**
- 62.60.246[.]210:443 (Actor A - Mining Pool)
- hxxp://162.55.234[.]175:4082/workersh (Actor B - Dropper)
- **File Indicators:**
- `/var/tmp/systemd-logind` (Malicious miner binary)
- **Behavioral Indicators:**
- Unexpected CPU throttling commands.
- Creation of unusual UDEV rules and systemd services.
## Response Actions
- **Containment:** Isolation of the affected Linux endpoint.
- **Eradication:** Removal of identified persistence mechanisms (UDEV rules, cron jobs, systemd services).
- **Recovery:** Revocation of all potentially compromised SSH keys and API tokens.
## Lessons Learned
- **AI Limitations:** AI agents like Codex lack security context and may "hallucinate" or provide remediation steps that mask symptoms (like CPU throttling) rather than addressing the root cause.
- **Co-infection:** A single vulnerability can lead to multiple, simultaneous threat actor presences.
- **Telemetry Importance:** Human-led SOC analysis was required to filter out "noise" generated by the AI troubleshooting attempts.
## Recommendations
- **Patch Management:** Immediately update Next.js and React dependencies to versions not affected by CVE-2025-55182.
- **Secure Coding:** Avoid "vibecoding" (AI-reliant coding) without rigorous security review of the generated architecture and dependencies.
- **Monitoring:** Implement managed EDR on Linux development environments to catch exploits that bypass standard signature-based tools.