A new malware family, PoeLLM (part of the Canto Incognito campaign), is targeting exposed artificial intelligence (AI) and large language model (LLM) infrastructure. The financially motivated campaign aims to deploy cryptocurrency miners, including XMRig, and expand its botnet. This highlights a growing trend of threat actors exploiting AI/LLM systems for resource-intensive activities like cryptojacking, underscoring the need for securing AI infrastructure.