PoeLLM malware hides its command server inside a poem and infects over 3,000 AI servers

[CosmosWizard]

Lumen's Black Lotus Labs has found a malware campaign it calls Canto Incognito, The Register reports. Since April 2026 it has infected more than 3,000 servers, mostly enterprise AI infrastructure. The goal is to mine cryptocurrency and grow a botnet. The researchers call it the first real world use they have seen of adversarial poetry, and admitted that this was a first for them

The trick is clever. The poem sits in a file called dash.css in a GitHub fork of the nodejs.org source code, and it has been updated 11 times. The malware pulls keywords from the poem and converts them to numbers through a hard coded dictionary. Those numbers make up the IPv4 address of its command server

Because the address lives in the poem, changing the poem moves the server. To a security scanner, a stylesheet with some verse in it looks completely harmless. It is a modern twist on steganography, hiding a message in plain sight. The researchers believe the poem itself was written by AI, which adds another layer to the story

At its peak the campaign hit more than 800 active servers a day. Most were exposed LiteLLM and Ollama instances, plus hundreds of Gotenberg and Gitea installs. It deploys the XMRig and Iron crypto miners. Researchers attribute it to an Italian speaking actor

The warning from the researchers is the bit everyone running AI tools should read. AI makes it easier to deploy tools like LiteLLM, Ollama and Gotenberg, but nobody checks whether those services are patched and protected from attackers. I have seen plenty of people spin up Ollama on a home server and open it to the internet without a second thought. This is the result

Is anyone here running Ollama or LiteLLM exposed to the internet? And how do you think security tools should deal with tricks like hiding data in poetry?

Poetry is the new AI security threat as PoeLLM malware infects 3K+ serverswww.theregister.com

[PeakTime]

Crypto mining on AI servers makes sense from the attacker's point of view. Those machines often have powerful GPUs and fast networks

Owners might not notice the extra load if they are already running heavy workloads. It is a nice place to hide

Cloud bills would show it eventually. By then the damage is done

[RicFlair_What?]

AI writing the poem is almost funny. AI tools being attacked by malware hidden in AI generated verse feels like a sci fi plot

Still, the real lesson is boring. Patch your servers and do not expose them without authentication. Firewalls and passwords stop most of this

[Midnight Wolf]

Ollama runs at home for me, but only on my local network. A quick check after reading this showed it was not exposed, thankfully. It is far too easy to forward a port and forget about it. Everyone running these tools should check today. Researchers have found thousands of open instances before