PoeLLM cryptomining malware was found on more than 3,400 servers during the Canto Incognito campaign. It uses four words from two poems on GitHub to conceal the command-and-control (C2) server address and redirect infected machines to new servers.
The primary targets are internet-exposed AI services and open-source tools such as LiteLLM, Ollama, Gotenberg, and Gitea. The malware is delivered by exploiting vulnerabilities in these services, then changes the servers used for control according to new, modified versions of a poem—11 versions in total.
Lumen’s Black Lotus Labs team has tracked the Canto Incognito campaign since April 2026. PoeLLM uses four words from two poems on GitHub to decode the IPv4 address of the C2 server.
The poem titled “On the Nature of Connection” has been modified 11 times, with each version pointing to a new server. This turns ordinary text into a subtle channel for hiding the malware’s control path.
Primary Targets Are Externally Exposed AI Services and Tools
The attack scope includes LiteLLM, a proxy server or AI gateway for calling LLM APIs through a single endpoint; Gotenberg, a Docker-based API for converting files to PDFs; Ollama, which runs open-weight models on users’ own hardware; and Gitea, a self-hosted Git platform.
Ollama is not exposed to the internet by default. Gotenberg also warns users not to expose it publicly. Ivanti Sentry, an enterprise gateway appliance, may also have been targeted, and one such instance helped Lumen discover the campaign.
From Vulnerability Exploitation to Cryptomining
The malware was installed by exploiting publicly exposed services. In the LiteLLM attack path, the intrusion is believed to have begun with a crafted POST request to the connection endpoint.
The vulnerability, CVE-2026-42271, allows two endpoints to execute commands supplied by attackers on the host without role validation, enabling payloads to be installed on the server.
The payload includes XMRig and Iron miners. Infected servers are then used for cryptomining, while also scanning for targets and serving as attack infrastructure for further intrusions.
Why Using Poems Helps Conceal the C2
The poem “On the Nature of Connection” was first committed to GitHub in April. Each version points to a new C2 server. Using a poem hides important information inside content that appears unrelated to malware, making suspicious activity harder to detect.
The malware extracts specific words from the poem and converts them into an IPv4 address to locate the C2 server. At the time of Lumen’s report, the operators had not changed this decoding method.
This mechanism is a form of obfuscation used to identify the C2 location. It is not an AI jailbreak, prompt injection, or adversarial poetry technique involving dangerous requests to an AI.
What the First Victims’ Traces Reveal
Lumen reported that more than 3,400 servers had been attacked. The first 900 victims had one thing in common: they had previously contacted an endpoint belonging to the Kryptex cryptomining service.
This suggests a possible financial motive, since infected servers were used for cryptomining, target scanning, and helping distribute subsequent attacks. Broad scanning began in May.
AI Infrastructure Has Become a Valuable Target
Lumen views AI infrastructure as attractive to attackers because externally accessible services may provide access to sensitive data and hardware—especially GPUs, which are valuable for compute-intensive workloads and cryptomining.
The risk is therefore not limited to a single machine. It can spread across an organization’s expanding attack surface as AI infrastructure grows. At the time the report was published, 3 of the 12 servers were still operating as C2 servers, and the campaign continued to infect new victims.
What Administrators Should Check Immediately
Start by reviewing connection logs against the indicators of compromise published on Lumen’s GitHub, auditing open-source services exposed to the internet, and closing unnecessary ports.
Fully patch network appliances and follow each product’s recommendations. LiteLLM should be updated to version 1.83.7 or later, while Ivanti Sentry should run R10.5.2, R10.6.2, or R10.7.1.
Lumen said it had blocked all traffic to and from PoeLLM’s C2 servers, but administrators should still inspect their own systems as soon as possible.
PoeLLM’s novelty lies in using poems to conceal C2 addresses—not in attacking AI models through prompt injection or adversarial poetry. The malware extracts designated words from the poem and decodes them into an IPv4 address that points to a new server.
The key lesson is that publicly exposed AI services and open-source tools require strict access controls, timely patching, and continuous connection-log monitoring. A small weakness in a system can become an entry point for malware.