Back Scworld

ComfyUI instances hijacked for cryptomining and proxy botnet | brief

Scworld • April 8, 2026

As reported by The Hacker News, a sophisticated attack campaign is actively targeting internet-exposed instances of ComfyUI, a popular platform for stable diffusion models, to integrate them into a malicious cryptocurrency mining and proxy botnet.

Threat actors are employing a custom Python scanner that continuously probes cloud IP ranges for vulnerable ComfyUI deployments. The exploitation leverages a misconfiguration in unauthenticated instances, allowing remote code execution through custom nodes. Once compromised, these servers are enlisted to mine Monero and Conflux cryptocurrencies using XMRig and lolMiner, respectively. Additionally, they are incorporated into a Hysteria V2 botnet, all managed via a Flask-based command-and-control dashboard. The campaign installs malicious nodes, often via ComfyUI-Manager, and employs techniques like disabling shell history and using "chattr +i" for persistence. The malware also actively targets and disrupts competing mining operations.

This campaign highlights the growing trend of exploiting open-source AI tools for illicit activities. With over 1,000 publicly accessible ComfyUI instances identified, the potential for financial gain incentivizes such opportunistic attacks.

Source: The Hacker News

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ComfyUI Servers Compromised for Cryptomining and Botnet Operations A significant wave of cyberattacks has targeted ComfyUI servers, converting them into a botnet for cryptomining and proxy operations. Researchers from Censys reported that since March 12, 2026, over 1,000 publicly accessible ComfyUI instances have been exploited by attackers. The attackers utilize a Python-based scanner to identify vulnerable servers and install malicious nodes without authentication. These compromised servers mine cryptocurrencies like Monero and Conflux, while being controlled via a Flask-based command-and-control dashboard. The malware employed is sophisticated, featuring evasion techniques and multiple revival mechanisms that persist through system reboots. ComfyUI, an open-source toolkit for AI image generation, is particularly vulnerable due to misconfigurations allowing public access. Administrators are advised to restrict access to these servers to internal networks or VPNs to mitigate risks. Detailed indicators of compromise (IOCs) have been provided for detection and prevention efforts. 3 sources 74

Extracted Entities

ComfyUI instances hijacked for cryptomining and proxy botnet | brief

The full story

Extracted Entities

Attack Types (2)

Malware (2)

MITRE ATT&CK (3)

Platforms (2)

Tools (2)