AI Servers Hijacked for Crypto Mining & Data Theft

A significant security vulnerability has been discovered in OpenWebUI, a popular open-source interface for interacting with large language models. Researchers identified 98 instances of OpenWebUI that were left completely unprotected by authentication measures. This oversight left these servers exposed to malicious actors.

Within the discovered vulnerable instances, 45 had already been compromised. These compromised servers were found to be actively mining cryptocurrency and stealing sensitive user credentials. The malware utilized complex evasion tactics, including byte reversal and data decompression, to avoid detection by security systems.

Further analysis revealed that 33 of the unprotected servers exhibited configuration conflicts, while only 11 appeared to be functioning normally. The malicious campaign also incorporated Discord webhooks, notifying developers upon each new server compromise. Security recommendations include enabling authentication, implementing IP whitelisting, and setting up monitoring for unauthorized uploads and model execution.