NadMesh Botnet Targets Exposed AI and Model Context Protocol Servers, Claims Thousands of Stolen AWS Keys

A newly discovered Go-based botnet dubbed NadMesh is systematically hunting exposed artificial intelligence services and Model Context Protocol (MCP) servers, harvesting cloud credentials at scale and signaling a shift from indiscriminate worm behavior toward an industrial-grade, return-on-investment-driven attack platform. Uncovered in early July 2026 by researchers at QiAnXin XLab, the malware combines automated internet-wide reconnaissance with more than 20 distinct remote code execution vectors to compromise AI infrastructure that has been left accessible on the open internet.