CybersecurityEarly report1h agoOctober 8, 2026 · 12:14 AM UTC

PoeLLM malware builds botnet targeting AI services

Researchers have identified malware named PoeLLM that has compromised over 3,400 servers since April by targeting open-source AI services. The malware uses words hidden in a seemingly harmless poem on GitHub to generate command-and-control server addresses, making it harder to detect and disrupt. PoeLLM mainly exploits vulnerabilities to build a cryptocurrency-mining botnet but could allow remote code execution on affected servers, posing further risks.

Why it mattersThis attack exploits AI infrastructure for illicit mining and possibly broader abuse, highlighting new ways threat actors hide command infrastructure. It raises concerns for operators of public AI services, which are increasingly targeted by sophisticated threats.

PoeLLM compromised over 3,400 servers since April
Uses poem on GitHub to hide C2 infrastructure
Targets open-source AI services like LiteLLM and Ollama
Botnet used for exploit scanning and crypto mining
Malware enables remote code execution on some servers

Sources covering this

CyberScoopPoeLLM malware has assembled a sweeping botnet, taking technical cues from a poem3:00 PM →The RegisterHeadline onlyPoetry is the new AI security threat as PoeLLM malware infects 3K+ servers4:01 PM →

PoeLLM malware builds botnet targeting AI services

Sources covering this

In this story

More in Cybersecurity

Four states sue TP-Link over router security claims

Outlook will block MSIX file attachments in November

Major software vendors patch critical vulnerabilities

PoeLLM malware infects over 3,400 AI servers for cryptomining