Project
Open-source command-line program for mining Monero cryptocurrency, often abused by attackers for unauthorized cryptojacking on compromised systems.
Lumen's Black Lotus Labs found a cryptominer on more than 3,400 servers, mostly running vulnerable AI services. Each poem edit moves the hosts to a new control server, so patching and closing public ports are the controls a server owner holds.
Reality
Attackers are chaining two unpatched AhsayCBS flaws to run code as SYSTEM and plant webshells and XMRig miners, according to Huntress. Managed service providers are the main users of the console, so the hosts being hit are the ones that manage backup users and policies for clients.
Perspective Coverage
6 publishersReality
GhostAction's credential-stealing GitHub workflow has reached tens of thousands of repositories through more than 500 accounts since October 7, Socket says. Any repository carrying the file should be treated as having lost its Actions secrets and every key in its git history.
Reality
Lumen's Black Lotus Labs says the PoeLLM cryptomining botnet has compromised more than 2,100 servers, many running exposed LiteLLM or Ollama. Each host it takes then mines and scans for the next, so an AI server left open to the internet is attack surface to lock down.
Perspective Coverage
6 publishersReality
ConnectWise's September 3 advisory promises a CVE and a fix within the week, so until one lands the only control is a per-role permission change. Huntress says the spread is already worm-like across newly connected machines.
Perspective Coverage
3 publishersReality
CISA's exploited-vulnerability catalog now holds entries for LiteLLM, Kestra and Starlette, according to a dev.to writeup, and the quickstart docs for those tools still keep provider API keys in the process environment an attacker reads first.
Reality
Huntress says the modified client waits for a new host connection, then uses ScreenConnect's own file transfer and Run functions to place scripts on the operator's machine, which is why the interim guidance is a config toggle.
Reality
MayaBot only shows up in 2022, seven years into the operation, and one branch of the funnel ends in a phone call to a scam call centre. That leaves the search referral and the redirector domains as the constants worth detecting.
Reality
Microsoft Security Research says intruders who reached exposed LiteLLM, RAGFlow and Kestra deployments went for provider keys and database URLs first. It can name a confident initial vector in only one of the three cases.
Reality
Three Microsoft investigations into AI middleware ended in stolen keys, persistence and compute abuse. The remediation list is ordinary infrastructure hygiene, applied to plumbing nobody inventoried.
Reality
Wiz says attackers are using the WebDriver API's documented remote-command features to plant a modified XMRig on internet-facing Selenium Grid nodes. Authentication is off by default.
Reality
Wiz says a TeamCity honeypot exposing JDWP was mining Monero within hours, and GreyNoise counted more than 6,000 unique IPs scanning for the protocol in 90 days.
Reality
Unit 42 says the C++ loader reads encrypted commands from immutable smart contracts over public RPC endpoints, which turns takedown work into traffic monitoring.
Reality