🦠 Ransomware & Malware

Hackers Hijack 1,000 ComfyUI Servers for a Stealthy Crypto Mining Empire

What if your AI image generator was secretly mining crypto for hackers? A new botnet's turning exposed ComfyUI servers into a profit machine, exploiting custom nodes with ruthless efficiency.

Threat Digest Apr 07, 2026 4 min read
Infographic showing Python scanner exploiting ComfyUI custom nodes for botnet takeover

⚡ Key Takeaways

  • Over 1,000 exposed ComfyUI instances exploited via custom node RCE for cryptomining and proxy botnets. 𝕏
  • Attackers use Python scanners, auto-install malicious nodes, and advanced persistence like immutable binaries. 𝕏
  • This signals AI tools becoming prime botnet targets, echoing Mirai-era IoT vulnerabilities. 𝕏
Published by

Threat Digest

Threat intelligence. Zero noise.

#Censys report #ComfyUI botnet #ComfyUI exploit #Stable Diffusion exploit #XMRig Monero #XMRig malware #cryptomining botnet #cryptomining campaign #custom node exploit #remote code execution

Worth sharing?

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by The Hacker News

Related Stories

📬

Stay in the loop

The week's most important stories from Threat Digest, delivered once a week.

No spam. Unsubscribe any time.