Attacker exploits misconfigured AI tool to run AI-generated payload

Sysdig Threat Research Team observed attackers exploit a misconfigured, internet-exposed Open WebUI instance to upload an obfuscated, AI-assisted Python Tool that executed and deployed cryptominers (T-Rex, XMRig) on Linux and a sophisticated Java-based infostealer/loader on Windows. The malware employed strong defense-evasion techniques (compiled LD_PRELOAD processhider and an argv-hiding library), persisted via a masqueraded systemd service and JDK-based loader, used a Discord webhook for notifications/C2, and included numerous IoCs (file hashes, URLs, wallet addresses, and an IP).