{
  "id": 14060668,
  "title": "Thousands of computers infected with malware that generates digital currencies",
  "url": "https://urgent.news/2026/10/12/thousands-of-computers-infected-with-malware-that-generates-digital",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-12T22:46:38.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/hacksgr/thousands-of-computers-infected-with-malware-that-generates-digital-currencies-1i8o"
  },
  "original_language": "en",
  "account": "Security experts have discovered a crypto-mining operation, named Canto Incognito, that has compromised more than 3,400 servers. The malicious campaign primarily targets unpatched Artificial Intelligence services, such as LiteLLM and Ollama, which possess powerful hardware ideal for mining digital currencies. The attackers employ a unique command-and-control method, concealing their control addresses within a two-stanza poem hosted on GitHub. This repository has been updated 11 times to redirect infected nodes, which are subsequently utilized for mining cryptocurrencies and searching for additional vulnerable targets. The poem's text is altered each time a new redirection is needed. The infection primarily impacts computing systems that have AI services with insufficient security updates. Once a system is compromised, mining software like XMRig and Iron, connected to the Kryptex service infrastructure, is activated. The infected system then serves to spread the attack by hunting for other susceptible systems on the internet. The attack's objectives are financially motivated, and the perpetrators have already blocked communication to the control locations used by the attackers, restricting the capability to send new commands to the infected systems. Lumen's Black Lotus Labs team identified and reported the attack.",
  "summary": "Security researchers have identified a cryptomining campaign, Canto Incognito, that has infected over 3,400 servers. The operation focuses on unpatched versions of AI services like LiteLLM and Ollama. The attackers utilize a novel command-and-control mechanism, embedding instructions within a two-stanza poem hosted on GitHub. This repository has been updated 11 times to redirect nodes, which are…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}