OpenWebUI Servers Hijacked for Crypto Mining and Data Theft

A malicious campaign has exploited vulnerable OpenWebUI servers, turning them into a network of cryptocurrency mining machines and information stealers. The campaign has been active since late 2024, affecting thousands of publicly accessible OpenWebUI instances due to weak security settings and misconfigurations. Researchers identified 14 different malware versions linked to the campaign, indicating ongoing development by a single threat actor. The attack exploits two information disclosure vulnerabilities, including CVE-2025-63391, which remains unaddressed in the latest OpenWebUI version. Despite attempts to notify OpenWebUI Inc. about the vulnerabilities, no response was received, leaving the issues unresolved. The scope of the impact is significant, with over 15,000 instances identified, primarily in data center hubs across the US, China, Germany, France, and Singapore. The vulnerabilities allow attackers to easily identify misconfigured servers, though additional configuration changes are necessary for successful exploitation. The investigation continues as researchers seek to understand the full extent of the campaign.

Key Points: • Over 15,000 OpenWebUI instances were found publicly accessible and vulnerable. • The campaign has been ongoing since late 2024, with 14 malware versions identified. • CVE-2025-63391 remains unpatched in the latest OpenWebUI version, posing ongoing risks.