Attackers use poem to infect 3,000 servers

Italian threat actors deployed PoeLLM malware that decodes instructions from AI-generated poems on GitHub to locate C2 servers. This campaign infected more than 3,000 devices by targeting multiple AI services, unlike previous attacks affecting roughly 2,500 victims. The latest update occurred in September 2026, expanding the botnet scope.