PoeLLM malware compromised thousands of exposed AI servers for cryptomining
What happened
Lumen's Black Lotus Labs described PoeLLM, a campaign that infects exposed AI and open-source services such as LiteLLM and Ollama, mines cryptocurrency on them and reuses them as scanners. Its command server address is hidden in a poem on GitHub. Lumen's takeaways cite over 3,400 victim servers, while its body text says almost 2,200.
PoeLLM gets its command-and-control address by reading keywords from a poem in a GitHub repository and mapping them to an IP address; the operator moves servers by changing four words, and the poem was edited 11 times. The payload includes XMRig and Iron miners, a remote shell and scanning and exploit tools, and infected hosts scan ports 3000 and 4000 to find more targets such as LiteLLM, Ollama, Gotenberg and Gitea. Activity has run since at least April 2026 and peaked near 800 active servers in a day in June. Lumen assesses with moderate confidence that the operator is Italian-speaking and financially motivated.
How it happened
Leaky AI product: Unsecured AI infrastructure. Software used to run AI systems was reachable from the internet without proper protection and was exploited.
The software involved works with many AI models, so no single model maker was involved. The product was LiteLLM, Ollama, which is open source, a type of AI building block. Vulnerability IDs: CVE-2026-42271.
Impact
Data was exposed. Data involved: unknown. Many organizations were affected.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 7 Oct 2026.
Lumen published indicators of compromise and advice to block the command servers, audit external exposure of newly installed open-source tools, restrict service ports, keep AI tools patched and keep APIs such as Gotenberg behind a firewall. The post does not describe vendor action.