Poetry is the new AI security threat as PoeLLM malware infects 3K+ servers

A persistent cryptojacking campaign named PoeLLM has infected more than 3,000 servers — primarily in the US and Western Europe — by exploiting vulnerable AI-related services and other internet-facing software (including a referenced Ivanti Sentry CVE-2026-10520). The malware uses a novel "adversarial poetry" technique hosted on GitHub to encode and rotate command-and-control IPs, deploys cryptocurrency miners (XMRig, Iron, Kryptex), and converts compromised machines into scanners and exploit servers to propagate the botnet.