PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

A new malware family called Canto Incognito has infected over 3,400 servers, targeting exposed AI and LLM infrastructure to deploy cryptocurrency miners and expand a botnet. The financially motivated campaign installs miners on compromised systems, leveraging AI infrastructure for illicit crypto mining. Researchers warn of the growing threat to unsecured AI and LLM deployments.