New Nad Mesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens
Summary: A Go botnet named NadMesh appeared in early July, scanning exposed AI services such as ComfyUI, Ollama, n8n, Open WebUI, Langflow and Gradio, and its operator dashboard claims 3,811 unique AWS keys. QiAnXin's XLab named the malware after the "n4d mesh controller" string in its source and reported that it harvests cloud keys from environment variables, Kubernetes service account tokens, and files including ~/.aws/config, .env and ~/.docker/config.json.
What you should know: The operator's own dashboard scores success on an allowlist that explicitly excludes the Ollama and AWS harvest, so the scoreboard does not count the cloud credentials actually being taken. XLab's observed exploit traffic still runs mostly to Docker containers API RCE at 30.31% and Jenkins script console RCE at 22.28%, vectors no patch closes.
Read the original at The Hacker News ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026