Malware hid its command address inside a poem on GitHub and hit 3,000 servers
The PoeLLM malware read four marked words from a poem posted to GitHub and mapped them to a command-and-control address — meaning attackers could redirect it just by editing the verse. Lumen's Black Lotus Labs, which named the campaign Canto Incognito, says more than 3,000 servers have been infected since April 2026, mostly in the US and Western Europe.
1 min read