Summary
Security researchers have documented PoeLLM, a malware campaign targeting exposed AI inference servers to hijack their GPU resources for cryptocurrency mining. PoeLLM scans for publicly accessible large language model API endpoints — inference servers running open-source models such as Ollama, LM Studio, and similar self-hosted LLM deployments — and exploits misconfigured or unauthenticated endpoints to deploy cryptomining payloads that consume the server’s GPU capacity. The campaign represents a novel attack class targeting the rapidly expanding population of self-hosted AI inference infrastructure.
Timeline
| Date | Event |
|---|---|
| October 2026 | PoeLLM malware campaign identified targeting exposed AI inference servers |
| Oct 7, 2026 | Security researchers publish PoeLLM analysis; BleepingComputer reports |
What Happened
The proliferation of self-hosted LLM inference infrastructure has created a new attack surface that security teams have been slow to incorporate into their threat models. Organizations and developers running open-source LLM inference servers often expose API endpoints on public IP addresses to enable remote access, replicating the convenience of cloud AI APIs without the authentication and access controls that cloud providers implement by default. PoeLLM exploits this gap by scanning for unauthenticated or weakly authenticated inference API endpoints and deploying a cryptomining payload that runs as a background process on the inference server.
AI inference servers are particularly valuable targets for cryptomining because they are specifically provisioned with high-end GPUs — the same hardware used for cryptocurrency mining. A single exposed inference server running multiple high-end GPUs can generate significant mining revenue while the legitimate owner pays the electricity and hardware costs. The PoeLLM campaign is the latest in a pattern of attackers targeting emerging infrastructure categories before security practices mature: the same pattern was documented with exposed Docker APIs, Kubernetes clusters, and cloud metadata endpoints in prior years. Organizations running self-hosted LLM inference servers should immediately audit endpoint exposure, implement authentication on all API endpoints, and restrict access to known IP ranges or VPN.
Note on Domain Intelligence
PoeLLM does not operate legitimate clearnet infrastructure. Domain intelligence scores are not applicable to this bulletin.