Fake OpenAI Codex UI Steals Authentication Tokens

Key Takeaways

• A seemingly legitimate npm package, “codexui-android,” and two associated Android applications were found to be secretly stealing OpenAI Codex authentication tokens.
• The malicious code was deeply embedded, executing automatically upon launch and bypassing typical code audits by existing only in the distributed package, not its public GitHub repository.
• Attackers gained full access to critical authentication data, including refresh tokens, which could allow indefinite impersonation of affected developers.
• The threat actor, linked to the alias “BrutalStrike” with millions of app downloads, leveraged a sophisticated supply chain attack to maximize victim exposure.

Sophisticated Supply Chain Attack Targets OpenAI Codex Developers

A deceptive npm package, designed to appear fully functional and legitimate, has been uncovered actively siphoning OpenAI Codex authentication tokens from unsuspecting developers. This clandestine operation successfully compromised credentials from those who integrated the package into their projects. Detailed findings regarding this threat are available in a comprehensive report.

The npm package, identified as codexui-android, masqueraded as a remote web user interface for OpenAI Codex. It exhibited no overt signs of malicious intent, cultivating a genuine user base and achieving approximately 27,000 weekly downloads. Furthermore, it maintained an active GitHub repository, all while covertly exfiltrating credentials in the background.

Covert Operation and Evasion Tactics

The malicious activity persisted for approximately one month before its detection. Every version of the package released during this period contained hidden code that activated immediately upon the tool’s launch, requiring no user interaction. This malicious logic executed prior to any legitimate application code, granting it unfettered access to stored authentication files from the very beginning of the startup process.

According to a report by Aikido, shared with Cyber Security News (CSN), the malicious behavior was identified after discovering that the published npm package contained additional code not present in its public GitHub repository. This deliberate discrepancy made the malicious payload nearly undetectable through standard code audits. Developers examining the source code would find nothing suspicious, as the token theft mechanism was exclusively embedded within the distributed package itself.

The exfiltration routine specifically targeted the auth.json file located in the user’s Codex home directory. Once retrieved, the contents were XOR-encrypted using the key “anyclaw2026,” subsequently base64-encoded, and then silently transmitted to an attacker-controlled server. The endpoint for this data transfer was deliberately named to mimic a legitimate Sentry error-reporting connection, making it easy to overlook during routine network monitoring.

The breadth of the stolen information was particularly alarming. The package successfully captured the access token, refresh token, ID token, and account ID in a single operation. Given that refresh tokens generally do not expire, an attacker possessing these could maintain persistent, silent impersonation of the victim indefinitely.

Malicious Logic and Stealthy Communication

The core of the attack resided in a malicious file within the package, chunk-PUR7OUAG.js, which executed automatically at module load without requiring any explicit function call or triggering condition. A comment found in the source map explicitly stated that the tokens would be sent “always,” irrespective of other functionalities. This indicates a deliberate and sophisticated attempt to embed the malicious payload within an otherwise functional product.

The exfiltration endpoint, sentry.anyclaw[.]store/startlog, was strategically chosen to blend in with the package’s legitimate Sentry error-reporting traffic. This design ensured that developers monitoring network activity would observe what appeared to be normal telemetry, thereby masking the actual data theft. This level of camouflage necessitated an in-depth investigation to uncover.

The threat actor invested significant effort into developing a credible and useful project to serve as a cover. This very legitimacy became the primary vector for the attack. As AI tools gain widespread adoption and developers increasingly seek productivity shortcuts, similar supply chain attacks are anticipated to become more prevalent.

Android Apps Extend Attack Reach

The npm package was not the sole delivery mechanism for this threat. The same author also published an Android application on Google Play titled “OpenClaw Codex Claude AI Agent” (package ID: gptos.intelligence.assistant). This application automatically downloaded and installed the malicious npm build every time it launched. A second Google Play Store application, a paid productivity tool named “Codex” with over 10,000 installs, utilized the identical codebase and exfiltration chain under a different application ID.

The Android application initially appeared benign during pre-publish scans and had a modest size of 26 MB. Upon its initial launch, it extracted a Linux environment into private storage, executed Node.js within this environment, and then installed the malicious npm package from the registry without specifying a version. This critical detail meant that any device running the app would consistently pull the most current malicious build available on the npm registry.

Once a user authenticated into Codex within the application, the auth.json file containing their credentials was written to storage. The malicious npm package would then read and transmit this file to the attacker’s server.

Aikido’s investigation has linked the publisher of these malicious assets to the alias “BrutalStrike,” who is also associated with a game of the same name boasting over five million downloads on the Play Store. This connection raises significant concerns regarding the potential scale and impact of this credential theft campaign.

What You Should Do

• Immediately revoke and rotate all OpenAI Codex credentials if you have used the codexui-android npm package or either of the associated Android applications (“OpenClaw Codex Claude AI Agent” or “Codex”).
• Monitor outbound network connections for any traffic directed to sentry.anyclaw[.]store, which is the confirmed exfiltration endpoint for this campaign.
• Perform a thorough audit of your development environment and applications for the presence of the codexui-android package or the malicious Android applications.
• Implement strict supply chain security practices, including vetting npm packages, verifying author legitimacy, and regularly scanning dependencies for known vulnerabilities and anomalies.
• Exercise caution when downloading third-party applications or libraries, especially those relating to emerging technologies like AI, and prioritize official or well-vetted sources.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.