PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

A new malware family named PoeLLM has been identified targeting exposed AI and large language model (LLM) infrastructure. The financially motivated campaign, dubbed Canto Incognito, has compromised over 3,400 servers. The malware deploys cryptocurrency miners and expands a botnet by leveraging vulnerable AI/LLM endpoints. Cybersecurity researchers are raising alarms about the scale and sophistication of the operation. The campaign highlights growing risks to AI infrastructure as it becomes an increasingly attractive attack surface for threat actors seeking computational resources for crypto mining.