Hackers Use GitHub

Cybersecuritynews •Tushar Subhra Dutta • October 8, 2026

Hackers are using a poem hosted on GitHub to guide PoeLLM malware toward its command-and-control servers, turning exposed AI infrastructure into a growing cryptocurrency-mining botnet. The campaign targets internet-facing services, including LiteLLM and Ollama, while also affecting Gotenberg PDF converters and Gitea development servers. Active since at least April 2026, PoeLLM uses selected words in […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

PoeLLM Malware Compromises 3,400+ AI Servers via GitHub Poem The PoeLLM malware campaign, tracked by Lumen Technologies' Black Lotus Labs, has infected over 3,400 servers since April 2026, primarily targeting exposed AI services like LiteLLM and Ollama. The malware cleverly hides its command-and-control (C2) server addresses within a poem posted on GitHub, allowing attackers to rotate infrastructure with minimal detection. The campaign, dubbed Canto Incognito, is believed to be financially motivated, utilizing compromised servers for cryptocurrency mining and scanning for additional victims. Key vulnerabilities exploited include CVE-2026-42271 in LiteLLM and CVE-2026-10520 in Ivanti Sentry. The operation has seen peak activity of nearly 800 infected servers per day, with a concentration of victims in the U.S. and Western Europe. Researchers have noted that the malware can also enable remote code execution, raising concerns about further exploitation. 18 sources 72

Extracted Entities

Hackers Use GitHub

The full story

Extracted Entities

Attack Types (2)

Companies (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (3)

Tools (1)