PoeLLM Malware Compromises 3,400+ AI Servers for Cryptomining

PoeLLM is a malware campaign active since April 2026 that has infected over 3,400 servers (with daily peaks of ~800), targeting exposed AI services (LiteLLM, Ollama, Gotenberg, Gitea) by exploiting CVE-2026-42271, CVE-2026-48710 and likely other flaws. The malware derives C2 addresses from a poem hosted on GitHub to evade detection, deploys cryptominers (XMRig, Iron, and Kryptex-connected miners), and turns compromised hosts into scanners and exploit launchpads; researchers note activity concentrated in the U.S. and Western Europe and language artifacts suggesting an Italian-speaking operator.