PoeLLM Malware Infects 3,400+ Servers to Expand Crypto Mining Botnet

A malware family named PoeLLM has infected over 3,400 servers hosting AI and large language model infrastructure since April 2026, deploying cryptocurrency miners and expanding its botnet. The malware cleverly hides its command-and-control address within a poem on GitHub and targets enterprise-facing AI deployments primarily in the US and Western Europe.