Hackers esconderam endereços de servidores em um poema no GitHub e comprometeram mais de 3.400 máquinas. Entenda o caso PoeLLM.

Quoth the LLM, 'More and more'

その詩にはアドレスが隠されていました。 2025年12月9日、discord.jsのフォークに短い詩が現れました。詩の中の数字は、コマンドサーバーのアドレスをエンコードしたものです。Linux向けインプラントはGitHubからこの詩を読み取り、そのアドレスに接続します。詩を書き換えれば、それを読むすべてのインプラント

Canto Incognito has infected over 3,400 servers, using exposed AI and LLM infrastructure for crypto mining and botnet growth.

Uma nova campanha de ciberataques está a focar-se em servidores de inteligência artificial expostos na internet para minerar criptomoedas e expandir uma rede de máquinas infetadas. Batizado de PoeLLM, este malware já comprometeu mais de 3.400 sistemas na Europa Ocidental e nos Estados Unidos, aprove

A weird new botnet called PoeLLM hides its control servers in a GitHub poem while hijacking thousands of exposed AI and dev boxes for cryptomining.

Black Lotus Labs discovered a cryptomining botnet campaign called Canto Incognito that has infected over 3,400 servers using malware dubbed PoeLLM. The malware retrieves command and control server addresses hidden within a poem posted on GitHub. PoeLLM targets exposed AI services and open-source tools to mine cryptocurrency and propagate to additional victims. The researchers attribute the campaign to an Italian-speaking threat actor.

Security Affairs Malware newsletter includes a collection of the best articles and research on malware in the international landscape Malware Newsletter ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure   UAC-0277: ClickFix on compromised websites to spread LUNEXSTEALER MALFEX – A malicious npm postinstall no advisory has caught for fourteen months   Canto incognito: tracking the PoeLLM malware […]

Canto Incognito has infected over 3,400 servers, using exposed AI and LLM infrastructure for crypto mining and botnet growth.

Likeliest path into LiteLLM servers was a bug with a fix since April.

Lumen's Black Lotus Labs says PoeLLM malware has hit more than 3,400 servers, most of them exposed AI tools like LiteLLM and Ollama.

PoeLLM botnet hides its command-and-control address in a GitHub poem, compromising 3,400-plus servers running AI tools to mine cryptocurrency.

PoeLLM botnet hides its command-and-control address in a GitHub poem, compromising 3,400-plus servers running AI tools to mine cryptocurrency.

The PoeLLM botnet, tracked since April 2026, uses four words in a poem on GitHub to steer infected AI servers to new mining controllers.

Likeliest path into LiteLLM servers was a bug with a fix since April.

PoeLLM malware reads a GitHub poem to find its C2 servers and has hit more than 3,400 servers, mostly AI tools like LiteLLM and Ollama.

PoeLLM botnet hides its command-and-control address in a GitHub poem, compromising 3,400-plus servers running AI tools to mine cryptocurrency.

2026年4月から追跡されているボットネット「PoeLLM」は、GitHub上の詩にある4つの単語を使い、感染したAIサーバーを新たなマイニング用制御サーバーへ誘導する。

Quoth the LLM, 'More and more'

Quoth the LLM, 'More and more'

PoeLLM malware uses a GitHub-hosted poem to rotate C2 servers while targeting exposed LiteLLM, Ollama and other AI infrastructure.