PoeLLM malware turns exposed AI servers into cryptomining botnet

· Cybersecurity

Researchers are warning about a financially motivated malware family dubbed PoeLLM that targets exposed AI and large language model infrastructure to deploy cryptocurrency miners and expand a botnet. The campaign has infected more than 3,400 servers, according to the reports, and turns compromised machines into scanners and exploit launchpads for further attacks. The targeting is notable: as organizations rush LLM and GPU infrastructure into production, misconfigured or unauthenticated AI services become high-value, high-bandwidth assets for attackers. The incident fits a broader pattern of criminals opportunistically harvesting compute from whatever new infrastructure class is widely deployed and poorly secured.

Why it matters：It marks AI and LLM servers as a new, attractive target class for financially motivated attackers, signaling that compute infrastructure security now directly affects AI operations.

Key points

  • The campaign has infected more than 3,400 servers, researchers say.
  • Compromised hosts are used as scanners and exploit launchpads to grow the botnet.
  • The malware is financially motivated and deploys cryptocurrency miners.

Sources (original reporting)

More stories from this day