PoeLLM malware infects servers by hiding commands in a poem on GitHub
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Attacks are getting more inventive: defenders now have to read even poetry.
According to The Register, citing Lumen's Black Lotus Labs, the PoeLLM malware, built for covert cryptocurrency mining and botnet building, has infected more than 3,000 servers since April 2026, peaking at more than 800 active at once. The addresses of the command servers are stored in the poem "On the Nature of Connection" on GitHub, which was updated 11 times: the text looks like art and does not alarm defenses. The campaign was named "Canto Incognito"; the targets are vulnerable LiteLLM, Ollama, Gotenberg, Gitea and possibly Ivanti Sentry. Researchers link it to an attacker in Italy.
Sources 1