Researchers from Black Lotus Labs identified a malware campaign dubbed Canto Incognito, which utilizes a technique described as malicious poetry to manage its command-and-control infrastructure. The malware, named PoeLLM, targets vulnerable AI services such as LiteLLM and Ollama.
The malicious program scans a poem hosted on GitHub, extracting specific keywords that are converted into numbers based on a hardcoded dictionary. These numbers form an IPv4 address, allowing the malware to connect to a remote server for instructions.
This method allows the attacker to update the command server address by simply modifying words in the GitHub-hosted poem. The text has been updated 11 times since its initial publication, with the most recent change occurring in September 2026.
Once connected, the malware typically deploys the XMRig miner to extract Monero cryptocurrency. Additionally, the program functions as a scanner, identifying new vulnerable systems to expand the botnet.
The campaign has affected over 3,000 victims by targeting multiple AI-related services simultaneously. This approach contrasts with previous attacks that focused on single services, such as the LiteLLM supply chain attack which impacted approximately 2,500 systems.
