{"data":{"id":"8054a436-be62-40e8-94ba-7a13b9c6c45b","title":"New NadMesh Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens","summary":"NadMesh is a Go botnet (malware written in the Go programming language) that hunts for exposed AI services like ComfyUI and Ollama to steal cloud credentials, Kubernetes tokens (authentication keys for container orchestration systems), and access to AI models. The botnet prioritizes exploiting MCP (Model Context Protocol, a framework for AI tools), Docker APIs, and Jenkins systems, with observed attack traffic showing Docker vulnerabilities account for the largest portion of exploitation attempts.","solution":"N/A -- no mitigation discussed in source.","labels":["security"],"sourceUrl":"https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html","publishedAt":"2026-07-17T17:12:23.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain","data_extraction"],"issueType":"news","affectedPackages":null,"affectedVendors":["HuggingFace"],"affectedVendorsRaw":["ComfyUI","Ollama","n8n","Open WebUI","Langflow","Gradio","DeepSeek","GLM","Kimi","MCP","AWS","Kubernetes","Docker","Jenkins","Redis"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-07-17T17:12:23.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"inference","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}