PoeLLM malware hides its command server inside a poem and infects over 3,000 AI servers

[CosmosWizard]

Lumen's Black Lotus Labs has found a malware campaign it calls Canto Incognito, The Register reports. Since April 2026 it has infected more than 3,000 servers, mostly enterprise AI infrastructure. The goal is to mine cryptocurrency and grow a botnet. The researchers call it the first real world use they have seen of adversarial poetry, and admitted that this was a first for them

The trick is clever. The poem sits in a file called dash.css in a GitHub fork of the nodejs.org source code, and it has been updated 11 times. The malware pulls keywords from the poem and converts them to numbers through a hard coded dictionary. Those numbers make up the IPv4 address of its command server

Because the address lives in the poem, changing the poem moves the server. To a security scanner, a stylesheet with some verse in it looks completely harmless. It is a modern twist on steganography, hiding a message in plain sight. The researchers believe the poem itself was written by AI, which adds another layer to the story

At its peak the campaign hit more than 800 active servers a day. Most were exposed LiteLLM and Ollama instances, plus hundreds of Gotenberg and Gitea installs. It deploys the XMRig and Iron crypto miners. Researchers attribute it to an Italian speaking actor

The warning from the researchers is the bit everyone running AI tools should read. AI makes it easier to deploy tools like LiteLLM, Ollama and Gotenberg, but nobody checks whether those services are patched and protected from attackers. I have seen plenty of people spin up Ollama on a home server and open it to the internet without a second thought. This is the result

Is anyone here running Ollama or LiteLLM exposed to the internet? And how do you think security tools should deal with tricks like hiding data in poetry?

Poetry is the new AI security threat as PoeLLM malware infects 3K+ serverswww.theregister.com