More than 1,000 publicly accessible ComfyUI instances have been targeted in an active campaign that uses exposed deployments of the stable diffusion platform to install crypto mining and proxy botnet malware, according to a technical analysis from Censys published Monday.
KEY FACTS
- Target Internet-exposed ComfyUI instances with custom nodes
- Scale More than 1,000 publicly accessible instances were identified
- Payload The malware mines Monero and Conflux and adds hosts to a Hysteria V2 botnet
- Method Attackers abuse ComfyUI custom nodes that can run raw Python code
- Persistence The campaign uses repeated downloads, miner locks and watchdogs
The report said the attack starts with a Python scanner that sweeps cloud IP ranges for exposed ComfyUI systems and checks whether ComfyUI-Manager or vulnerable custom nodes are installed. If no exploitable node is present, the scanner can install one itself and retry the attack.
One of the packages used in the campaign, ComfyUI-Shell-Executor, was described as a malicious node that fetches a next-stage shell script from the operator-controlled server. The scanner also clears prompt history after exploitation and, in a newer version, re-downloads the shell script every six hours and reruns the workflow each time ComfyUI starts.
The shell script disables shell history, kills competing miners and launches mining software, while also using LD_PRELOAD to hide a watchdog process. The malware copies its binaries to multiple locations and uses the chattr +i command to make them harder to remove or rename, even with root privileges.
Censys also said the script targets a rival mining botnet referred to as Hisana by overwriting its configuration and occupying its control port with a dummy listener. The same infrastructure is used to manage compromised hosts through a Flask-based control panel and to deploy Hysteria V2, which suggests a proxy-selling operation.
WHY IT MATTERS
The campaign shows how publicly exposed AI workflow services can be turned into mining and proxy infrastructure when custom plugins allow unsafe code execution. It also adds to a broader rise in botnet activity that is targeting internet-facing systems across cloud, server and router environments.