PoeLLM malware infects exposed AI servers in cryptomining attacks
This campaign highlights the security risks of leaving powerful AI GPU clusters and developer tools poorly configured and exposed online.
• PoeLLM malware has infected over 3,400 exposed AI servers in cryptomining attacks targeting the US and Western Europe.
• The malware extracts command-and-control IP addresses by reading specific keywords from a poem hosted on GitHub.
• Compromised servers run miners and scan for further victims using vulnerabilities in LiteLLM and other tools.
Read more
October 7, 2026 27
