PoeLLM Uses a GitHub Poem to Infect More Than 3,000 Devices

Researchers at Lumen’s Black Lotus Labs identified malware that uses a poem on GitHub to find its command-and-control (C2) server. They call the technique “adversarial poetry” and said they had not seen anything like it before.

The malware, named PoeLLM, targets vulnerable internet-facing services such as LiteLLM and Ollama. It searches GitHub for a poem titled “On the Nature of Connection,” then matches specific words in the text to numbers in a hardcoded dictionary. Those numbers form an IPv4 address for the C2 server, which sends PoeLLM further instructions.

In most cases, the malware installs XMRig, a cryptocurrency miner that mines Monero. PoeLLM can also scan for more vulnerable systems, helping the campaign spread. The attacker can change the poem’s words to redirect infected devices to a new C2 address, without updating the malware. The poem has been updated 11 times since its initial commit; the latest update was in September 2026.

Black Lotus Labs said the campaign had more than 3,000 confirmed PoeLLM victims. It described the victims as spanning multiple vulnerable services. The researchers said the campaign’s broad targeting helped expand its botnet, while a separate LiteLLM supply chain compromise affected roughly 2,500 victims, according to open sources cited in their remarks to The Register.