# Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers

> Source: <https://www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/>
> Published: 2026-10-08 10:24:57+00:00

Thousands of hijacked servers have been looking up their command and control (C2) server in a poem posted on GitHub, according to Black Lotus Labs. The malware reading it, dubbed PoeLLM, breaks into exposed AI services and open-source tools, mines cryptocurrency on them and uses them to hunt for new victims. The researchers call the campaign Canto Incognito and believe it is the work of an Italian-speaking threat actor who appears to be in it … [More](https://www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/) 

The post [Cryptomining botnet hides C2 addresses in GitHub poem, infects over 3,400 servers](https://www.helpnetsecurity.com/2026/10/08/poellm-malware-github-poem-ai-servers/) appeared first on [Help Net Security](https://www.helpnetsecurity.com).