PoeLLM malware infects exposed AI servers in cryptomining attacks

A new cryptomining botnet called PoeLLM has been hijacking poorly secured AI infrastructure to mine cryptocurrency and spread further through networks. According to Lumen's Black Lotus Labs, the malware has already infected more than 3,400 machines, with up to 800 active in a single day, mostly running exposed tools like LiteLLM, Ollama, Gotenberg, and Gitea, alongside some Ivanti Sentry instances in the US and Western Europe. Unusually, the malware hides its command-and-control address inside a poem published on GitHub, converting specific words into an IP address through a built-in dictionary — the operators have already swapped the poem 11 times to rotate infrastructure. Besides deploying XMRig and Iron miners, the malware scans for and exploits CVE-2026-42271 in LiteLLM's MCP test endpoints, which researchers at Horizon.ai showed can be chained with CVE-2026-48710 for unauthenticated remote code execution, making prompt patching and limiting internet exposure of AI deployments essential.