aiqbench analysis
This article details a sophisticated supply chain attack where malware exploits open-source AI infrastructure like LiteLLM and Ollama to create a cryptocurrency-mining botnet, using a GitHub-hosted poem as an obfuscated command-and-control mechanism. The campaign highlights critical vulnerabilities in internet-facing AI services that allow attackers to pivot between compromised nodes for broader network scanning and exploitation. For the AI community, this underscores the urgent need for rigorous security auditing of open-source dependencies and runtime environments hosting large language model services.
Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure
Hackers are using a poem hosted on GitHub to guide PoeLLM malware toward its command-and-control servers, turning exposed AI infrastructure into a growing cryptocurrency-mining botnet. The campaign targets internet-facing services, including LiteLLM and Ollama, while also affecting Gotenberg PDF converters and Gitea development servers. Active since at least April 2026, PoeLLM uses selected words in […] The post Hackers Use GitHub-Hosted Poem to Control PoeLLM Malware Targeting AI Infrastructure appeared first on Cyber Security News.
Hackers are using a poem hosted on GitHub to guide PoeLLM malware toward its command-and-control servers, turning exposed AI infrastructure into a growing cryptocurrency-mining botnet. The campaign targets internet-facing services, including LiteLLM and Ollama, while also affecting Gotenberg PDF converters and Gitea development servers. Active since at least April 2026, PoeLLM uses selected words in the poem to calculate…
Excerpt shown under the publisher's RSS terms · 59 words · full text and figures are on the publisher's site
Related coverage
Hackers Abuse GitHub Actions to Exploit cPanel and WHM Servers and Steal Cloud Credentials
Cybersecurity News · Jul 23, 2026
UAT-6275 Hackers Exploit WinRAR Flaw to Target CIS Government Organizations
Cybersecurity News · Oct 15, 2026
Hackers’ Own Malware Infection Exposes Their RATs, Phishing Kits and Attack Infrastructure
Cybersecurity News · Aug 31, 2026
Top 10 Malware Used by Hackers Last Week to Launch Cyberattacks
Cybersecurity News · Jul 21, 2026