Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

ComfyUI cryptomining and proxy botnet campaign targeting exposed instances

Campaign
First reported
Last updated
Happening score
H score 58
1 unique sources, 1 articles

Summary

Hide ▲

An active ComfyUI campaign is scanning exposed instances, exploiting unsafe custom nodes, and enlisting compromised hosts into a cryptomining and proxy botnet. The operation matters because it enables unauthenticated remote code execution on vulnerable deployments and converts them into monetizable infrastructure. More than 1,000 publicly-accessible instances are in scope, indicating broad exposure.

Cases

ComfyUI exposure abuse for mining and proxying (1)

Related Happenings

Widespread exposure and misconfiguration in self-hosted AI infrastructure

Trend
H score76 First: 05.05.2026 13:30 Last: 05.05.2026 13:30 Sources 1

About this happening: A large-scale measurement found self-hosted AI infrastructure was being deployed with widespread exposure and no authentication, creating a broad risk of data theft, workf...

Open Happening

React2Shell (CVE-2025-55182) mass scanning and exploitation wave

Exploitation Wave
H score89 First: 20.02.2026 23:07 Last: 20.02.2026 23:07 Sources 1

About this happening: CVE-2025-55182 (React2Shell) was publicly disclosed on December 3, 2025 as a CVSS 10 remote code execution flaw in React Server Components. Since then, the vulnera...

Open Happening

Geta RAT, Ares RAT, and DeskRAT cross-platform credential-theft activity

Malware Activity
H score23 First: 11.02.2026 16:52 Last: 11.02.2026 16:52 Sources 1

About this happening: Geta RAT, Ares RAT, and DeskRAT are being deployed across Windows and Linux in phishing-led intrusions that enable credential theft, persistent access, and...

Open Happening

OpenClaw public-facing RCE exposure with public exploit code remote code execution flaw

Vulnerability
H score72 First: 09.02.2026 11:30 Last: 09.02.2026 11:30 Sources 1

About this happening: OpenClaw deployments exposed to the public internet face RCE risk, with 12,812 instances reportedly exploitable and public exploit code available. SecurityScorecar...

Open Happening

React/Next.js applications React2Shell RCE flaw (CVE-2025-55182)

Vulnerability
H score54 First: 09.02.2026 10:37 Last: 09.02.2026 10:37 Sources 1

About this happening: React2Shell (CVE-2025-55182) has been repeatedly exploited against React Server Components (RSC) and Next.js systems, with Huntress saying the first attempt it saw cam...

Latest development: 09.03.2026 23:45

Google reports that newly disclosed third-party flaws are increasingly being exploited for initial access to cloud environments, with React2Shell (CVE-2025-55182) and CVE-2025-24893 highlighted as frequent RCE examples. The report says attackers are weaponizing new flaws within days, with cryptominers observed within 48 hours of vulnerability disclosure.

Open Happening

Timeline

  1. 06.04.2026 03:00 2 articles · 3mo ago

    ComfyUI deployments targeted for botnet enrollment

    Initial Disclosure

    An active campaign targets internet-exposed ComfyUI deployments with a purpose-built Python scanner that sweeps cloud IP ranges, checks for ComfyUI-Manager, installs a vulnerable node package when needed, and weaponizes custom nodes for unauthenticated remote code execution. Compromised hosts are added to a cryptomining stack using XMRig and lolMiner, enrolled in a Hysteria V2 botnet, and subjected to persistence and cleanup steps including repeated shell-script downloads, prompt-history wiping, LD_PRELOAD hiding, and chattr +i locking; more than 1,000 publicly-accessible ComfyUI instances are in scope.

    Show sources
    Open in new tab