---
title: "PoeLLM cryptomining malware infects 3,400+ servers, mostly exposed AI tools"
url: https://www.parallelquant.com/posts/poellm-cryptomining-malware-infects-3-400-servers-mostly-exposed-ai-tool-4b3645
source_name: "Tom's Hardware"
source_url: https://www.tomshardware.com/tech-industry/cyber-security/cryptomining-malware-used-poetry-to-infect-more-than-3-400-servers-researchers-say-four-words-in-the-poellm-verse-changed-11-times-point-the-botnet-to-new-servers
published: 2026-10-11T11:45:00.000Z
topics: ["security", "open source"]
publisher: "Parallel Quant"
---

# PoeLLM cryptomining malware infects 3,400+ servers, mostly exposed AI tools

*2026-10-11 · Source: [Tom's Hardware](https://www.tomshardware.com/tech-industry/cyber-security/cryptomining-malware-used-poetry-to-infect-more-than-3-400-servers-researchers-say-four-words-in-the-poellm-verse-changed-11-times-point-the-botnet-to-new-servers)*

Lumen's Black Lotus Labs reports malware called PoeLLM has compromised more than 3,400 servers. Most of the victims were exposed AI tooling such as LiteLLM and Ollama, and the malware is used for cryptomining.

**Why it matters:** Self-hosted LLM gateways and runtimes are often deployed with default or no authentication, making them an easy new attack surface as local AI adoption grows. It echoes the broader theme in recent coverage that AI infrastructure itself, not just models, needs hardening and containment.

**Topics:** security, open source

---
Read the original: https://www.tomshardware.com/tech-industry/cyber-security/cryptomining-malware-used-poetry-to-infect-more-than-3-400-servers-researchers-say-four-words-in-the-poellm-verse-changed-11-times-point-the-botnet-to-new-servers
Canonical: https://www.parallelquant.com/posts/poellm-cryptomining-malware-infects-3-400-servers-mostly-exposed-ai-tool-4b3645
Published by Parallel Quant — https://www.parallelquant.com