PoeLLM Malware Infects 3,400+ AI Servers Using Poetry to Hide Cryptomining Botnet
A cryptomining campaign has compromised over 3,400 AI servers using PoeLLM malware that hides command-and-control addresses in a GitHub-hosted poem. The Canto Incognito operation targets exposed LiteLLM, Ollama, and other AI services, turning victims into cryptocurrency miners and exploit servers while evading detection through adversarial poetry.