Malware hides its C2 address inside an AI-written poem

A malware campaign that hides its command-and-control addresses inside an AI-written poem on GitHub has infected more than 3,000 internet-facing servers since April 2026, according to research published by Lumen's Black Lotus Labs on 7 October 2026 and shared with The Register.

The researchers call the campaign Canto Incognito and the malware PoeLLM. They say the operator is a financially motivated, Italian-speaking criminal, based on Italian-language comments in the malware and on the attacker's GitHub pages, and on netflow analysis suggesting the attacker is located in Italy. Victims are primarily in the US and Western Europe. At its peak the malware infected more than 800 active servers a day, and Black Lotus Labs says it continues to claim new victims.

Most victims were running vulnerable, internet-facing versions of LiteLLM and Ollama, two open source tools for running and routing large language models. Hundreds more were running Gotenberg, a PDF converter, and Gitea, a software development platform. The researchers say the attacker may also have targeted commercial software, including Ivanti Sentry. They first spotted PoeLLM while investigating an Ivanti Sentry flaw tracked as CVE-2026-10520. In early June 2026, according to the report, a compromised Ivanti Sentry victim contacted a dedicated server at 5.78.73.122, and shortly afterwards began scanning for other vulnerable devices.

The poem sits in a GitHub repository belonging to the user "ejejejdfbbebe". The repository is a fork of the nodejs.org website source code, and the poem is stored in a file called "dash.css". Titled "On the Nature of Connection", it was first committed on 13 April 2026 and has been updated 11 times since. Black Lotus Labs believes the poem itself was written by AI.

The malware works out where to phone home by parsing the poem. It extracts three phrases from fixed positions in the text, plus a fourth word found by locating the phrase "of distant servers" and walking backwards, then converts those words into numbers using a dictionary hard-coded in the malware body. The numbers combine into an IPv4 address. When the operator edits the poem, infected systems find the new C2 location.

"This is a first for us," the researchers told The Register, describing it as the first real-world use they have seen of adversarial poetry, a jailbreak technique that rewrites harmful prompts as verse to get past model safety guardrails. They said the poem works as a hiding place because it contains no links, no downloadable files and no encrypted text that scanners would flag.

Once inside, PoeLLM deploys the XMRig and Iron miners and connects victims to Kryptex mining infrastructure, using GPU hardware intended for AI workloads to mine cryptocurrency. It also turns compromised machines into vulnerability scanners and exploit servers, spreading the infection further.

Black Lotus Labs said the campaign appears unusual in targeting multiple AI-related services at once. By comparison, it said, this year's LiteLLM supply chain compromise focused on a single service and affected roughly 2,500 victims according to open sources. The full write-up lists the C2 IP addresses with first and last seen dates.