Security1 hOctober 7, 2026, 22:04

PoeLLM malware infects 2,100 AI servers in cryptomining attacks

The PoeLLM malware has compromised over 2,100 exposed AI servers running LiteLLM, Ollama, Gotenberg, and Gitea, turning them into scanners and cryptomining launchpads. It retrieves C2 addresses by extracting words from a poem hosted on GitHub, and victims communicate with Russian mining service Kryptex.

BleepingComputer

Open source

PoeLLM malware infects 2,100 AI servers in cryptomining attacks

Over 2,100 servers infected, peak of 800 active in one day
C2 addresses encoded in a GitHub poem, updated 11 times
Targets LiteLLM, Ollama, Gotenberg, Gitea, and Ivanti Sentry
Exploits CVE-2026-42271 in LiteLLM for unauthenticated RCE

#LiteLLM#Ollama#GitHub#Kryptex

ChainVeil attack hides malware in vite.config.js via forged merge commit

Security

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Security

Brevo supply chain attack injects malware into 100,000 websites

Security

PoeLLM malware infects 2,100 AI servers in cryptomining attacks

ChainVeil attack hides malware in vite.config.js via forged merge commit

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Brevo supply chain attack injects malware into 100,000 websites

World's most sophisticated malware attack reportedly now freely available on GitHub