NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure

Cybersecuritynews •Kavichselvan • July 19, 2026

A sharp structural shift has been identified in the botnet landscape. Security researchers at XLab have uncovered NadMesh, a Go-based botnet that has been spreading rapidly since early July 2026. This malware marks a distinct evolution from opportunistic worm behavior toward an industrial-grade, ROI-driven attack platform aimed squarely at Artificial Intelligence (AI) and Model Context […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

NadMesh Botnet Exploits 20+ RCE Vectors to Target AI Infrastructure The NadMesh botnet, identified in early July 2026, is a Go-based malware that utilizes over 20 remote code execution (RCE) vectors to hijack AI and Model Context Processing (MCP) infrastructure. Researchers at XLab reported that NadMesh employs Shodan to locate exposed systems, marking a shift from opportunistic attacks to a structured, ROI-driven platform. The botnet combines autonomous scanning, exploit delivery, and credential harvesting, affecting a wide range of internet-facing AI infrastructures. Its rapid deployment and high-volume operations pose significant risks to organizations utilizing AI technologies. Current efforts to mitigate the threat are ongoing, but the botnet's capabilities suggest a serious challenge for cybersecurity defenses. 2 sources 67

Extracted Entities

NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure

The full story

Extracted Entities

Attack Types (2)

Malware (1)

Tools (1)