Cryptomining malware used poetry to infect more than 3,400 servers (www.tomshardware.com)

A cybersecurity research team, Black Lotus Labs from Lumen, has reported a significant campaign known as Canto Incognito, which has infected over 3,400 servers with cryptomining malware named PoeLLM since April 2026. This malware ingeniously uses a two-stanza poem stored on GitHub as a command-and-control (C2) mechanism, allowing it to encode addresses that direct infected servers to new C2 locations as it evolves. Many of the compromised servers were running vulnerable open-source AI/LLM services, including LiteLLM and Ollama, indicating a growing trend of targeting AI infrastructure for financial gain due to its valuable data and hardware resources, like GPUs. The malware, which incorporates payloads like XMRig and Iron miners linked to Kryptex infrastructure, exploits vulnerabilities within publicly exposed services, most notably through a flaw in LiteLLM that was previously patched in April. The use of poetry as an obfuscation technique highlights the creativity of cybercriminals in camouflaging malicious activities. As the AI landscape expands, incidents like these may become more common, emphasizing the need for organizations to perform regular audits, patch known vulnerabilities, and monitor for indicators of compromise in their systems.