Carbonato Malware Hijacks Docker Hosts With AI

New Carbonato malware targets Docker hosts with unauthenticated APIs on port 2375, launching privileged containers and installing the Hermes Agent AI framework. Discovered in a registry with nearly 60 repositories and 4.3 GB of data, it spreads worm-like every five minutes, uses Telegram for control, and persists via cron jobs and SSH tunnels. Malwarebytes links it to Costa Rica.