AI Honeypots Snare Decentralized Cryptominer Dropper

Akamai analysts discovered a sophisticated fileless P2P cryptominer campaign that scans for exposed Ollama/LLM API ports (notably 11434) to deploy an automated installer (i.sh), execute a custom Go-built binary with an integrated libp2p stack, and run a throttled XMRig Monero miner while evading detection via process impersonation and memory-only execution; persistence is maintained through a root crontab that restarts the miner every 15 minutes and defenders are advised to monitor outbound connections, block unauthorized QUIC/443 flows, and inspect unusual memory paths.