Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Browse News Feed Stats Watchlists Beta About Contact

ComfyUI cryptomining and proxy botnet campaign targeting exposed instances

Campaign
First reported
Last updated
Happening score
H score 57
1 unique sources, 1 articles

Summary

Hide ▲

An active ComfyUI campaign is scanning exposed instances, exploiting unsafe custom nodes, and enlisting compromised hosts into a cryptomining and proxy botnet. The operation matters because it enables unauthenticated remote code execution on vulnerable deployments and converts them into monetizable infrastructure. More than 1,000 publicly-accessible instances are in scope, indicating broad exposure.

Cases

ComfyUI exposure abuse for mining and proxying (1)

Related Happenings

Widespread exposure and misconfiguration in self-hosted AI infrastructure

Target Trend
First: 05.05.2026 13:30 Last: 05.05.2026 13:30 Sources 1

About this happening: A large-scale measurement found **self-hosted AI infrastructure** was being deployed with **widespread exposure and no authentication**, creating a broad risk of data theft, workf...

Open Happening

React2Shell (CVE-2025-55182) mass scanning and exploitation wave

Exploitation Wave
First: 20.02.2026 23:07 Last: 20.02.2026 23:07 Sources 1

About this happening: **CVE-2025-55182 (React2Shell)** is being **actively exploited** across **React Server Components (RSC)** and **Next.js** environments, with reports now adding a **ransomware gang...

Open Happening

Geta RAT, Ares RAT, and DeskRAT cross-platform credential-theft activity

Malware Activity
First: 11.02.2026 16:52 Last: 11.02.2026 16:52 Sources 1

About this happening: **Geta RAT**, **Ares RAT**, and **DeskRAT** are being deployed across **Windows and Linux** in phishing-led intrusions that enable **credential theft**, **persistent access**, and...

Open Happening

OpenClaw public-facing RCE exposure with public exploit code remote code execution flaw

Vulnerability
First: 09.02.2026 11:30 Last: 09.02.2026 11:30 Sources 1

About this happening: **OpenClaw** deployments exposed to the public internet face **RCE risk**, with **12,812 instances** reportedly exploitable and **public exploit code** available. SecurityScorecar...

Open Happening

React/Next.js applications React2Shell RCE flaw (CVE-2025-55182)

Vulnerability
First: 09.02.2026 10:37 Last: 09.02.2026 10:37 Sources 1

About this happening: **React2Shell (CVE-2025-55182)** is being **heavily exploited** in **React Server Components (RSC)**, with Huntress observing attackers deliver **cryptocurrency miners** and new m...

Latest development: 09.03.2026 23:45

Google reports that newly disclosed third-party flaws are increasingly being exploited for initial access to cloud environments, with React2Shell (CVE-2025-55182) and CVE-2025-24893 highlighted as frequent RCE examples. The report says attackers are weaponizing new flaws within days, with cryptominers observed within 48 hours of vulnerability disclosure.

Open Happening

Timeline

  1. 06.04.2026 03:00 2 articles · 1mo ago

    ComfyUI deployments targeted for botnet enrollment

    Initial Disclosure

    An active campaign targets internet-exposed ComfyUI deployments with a purpose-built Python scanner that sweeps cloud IP ranges, checks for ComfyUI-Manager, installs a vulnerable node package when needed, and weaponizes custom nodes for unauthenticated remote code execution. Compromised hosts are added to a cryptomining stack using XMRig and lolMiner, enrolled in a Hysteria V2 botnet, and subjected to persistence and cleanup steps including repeated shell-script downloads, prompt-history wiping, LD_PRELOAD hiding, and chattr +i locking; more than 1,000 publicly-accessible ComfyUI instances are in scope.

    Show sources
    Open in new tab