<![CDATA[PoeLLM malware infects exposed AI servers in cryptomining attacks]]>A cryptomining campaign is actively targeting exposed AI services, using malware tracked as PoeLLM to transform compromised servers into scanners and exploit launchpads. According to reporting from BleepingComputer, the operation focuses on AI infrastructure that is left accessible, turning those systems into both mining nodes and staging points for further attacks.

The key facts as reported:

  • The malware family is called PoeLLM.
  • The campaign targets exposed AI servers.
  • Compromised hosts are repurposed for cryptomining and are also used to scan for and launch exploits against other systems.
  • No specific CVE ID, KB number, or advisory ID is provided in the source reporting, so none is referenced here.

For defenders, the practical takeaway is that any AI service reachable from the internet should be treated as a high-value target. Exposure of these services gives attackers both compute for mining and a foothold to pivot outward, so reducing external attack surface and monitoring for unexpected outbound scanning activity are sensible priorities.

Source: BleepingComputer

Does your organization expose any AI services to the internet, and if so, how are you limiting access to them?

]]>https://xploitlk.com/topic/602/poellm-malware-infects-exposed-ai-servers-in-cryptomining-attacksRSS for NodeTue, 27 Oct 2026 09:28:30 GMTWed, 07 Oct 2026 16:30:24 GMT60