New Carbonato malware uses AI agents to hijack exposed Docker hosts

Summary

ThreatDown, the Malwarebytes research team, reports a botnet called Carbonato that targets Docker daemons with an API exposed on port 2375 without authentication. The malware launches a privileged container on each host, opens a reverse SSH tunnel, installs Hermes Agent with a "GH0ST" persona that overwrites SOUL.md, and uses Telegram to receive tasks that collect AI API keys and SSH credentials.

Mitigation

To prevent infection, the researchers recommend keeping Docker daemon APIs off the network and requiring authentication on registries.

Topics

• AI agents

Related items

• MediumCVE-2026-127202: MLflow path traversal through model_id in the log outputs APISimilar attack · NVD/CVE Database
• MediumTrained to betray: How post-training supply chain attacks hijack coding agentsSimilar attack · Microsoft Security Blog
• LowAI chatbots are recommending fake retail websites, study findsSimilar attack · The Verge (AI)
• MediumPalo Alto tracks a massive Chinese AI attack that sadly lives up to industry fearsSimilar attack · CSO Online
• MediumAttackers Use Autonomous AI to Target Semiconductor, Defense and Civil Society SectorsSimilar attack · Palo Alto Unit 42