PoeLLM Malware Infects 3,400+ AI Servers

Cybersecurity researchers report a new malware family named PoeLLM infecting over 3,400 servers to expand a cryptocurrency mining botnet. The campaign, attributed to an Italian-speaking actor, targets exposed AI and large language model infrastructure. Evidence indicates the malware has been active since April 2026, with infections concentrated in the U.S. and Western Europe.