PoeLLM Malware Campaign Hijacks 3,400+ AI Servers Using Poem-Based Command Infrastructure

A sophisticated malware campaign dubbed PoeLLM has compromised over 3,400 servers worldwide since April 2026, targeting exposed AI and developer infrastructure to power a cryptocurrency-mining operation that disguises command-and-control instructions within GitHub-hosted poems. The threat has infected systems running widely-used open-source tools including LiteLLM, Ollama, Gotenberg, Gitea, and Ivanti Sentry instances across the United States and Western Europe, according to research from Lumen Technologies' Black Lotus Labs.