New Botnet Hunts Exposed AI Services for Cloud Keys and Kubernetes Tokens

Robert Moore · 2026-07-17

A new Go-based botnet called NadMesh surfaced in early July, and it's already making waves by hunting down exposed AI services. According to the operator's own dashboard, it has collected 3,811 unique AWS keys so far. That's a serious haul, and it highlights a growing vulnerability in how teams deploy AI tools. ### How NadMesh Finds Its Targets The botnet uses a Shodan harvester to keep its scan queue stocked with popular AI platforms. Think ComfyUI for image generation, Ollama for running local models, n8n for workflow automation, Open WebUI, Langflow, and Gradio. These are the tools that teams stand up fast, often without proper security measures in place. It's a classic case of speed over safety. When you're trying to get a project off the ground, the last thing on your mind is firewall rules or access controls. But that's exactly what NadMesh exploits. ### What's at Stake? Once NadMesh finds an exposed service, it goes after cloud keys and Kubernetes tokens. These credentials can give attackers full access to your cloud infrastructure. Imagine someone walking into your office and taking the keys to every server you own. That's the kind of damage we're talking about. Here's what attackers can do with those keys: - Spin up expensive cloud resources for mining or other malicious activities - Access sensitive data stored in databases or storage buckets - Deploy malware or ransomware across your network - Exfiltrate intellectual property or customer information The operator's dashboard claims 3,811 unique AWS keys, but the real number could be higher. This is just what they've captured so far. ### Why AI Services Are Vulnerable AI tools are often deployed quickly, with teams prioritizing functionality over security. It's easy to forget that these services are accessible from the internet. A misconfigured firewall or a default password can leave the door wide open. "The convenience of deploying AI services in minutes often comes at the cost of security," says Robert Moore, Lead Antidetect Browser Specialist & Digital Privacy Strategist. "Teams need to treat these tools with the same caution as any other internet-facing service." ### How to Protect Yourself If you're running any of these AI services, here's what you can do to stay safe: - Use strong, unique passwords for every service - Enable multi-factor authentication wherever possible - Restrict access to trusted IP addresses only - Regularly audit your cloud keys and rotate them frequently - Monitor for unusual activity in your cloud environment Taking these steps can make a big difference. It's not about being paranoid; it's about being prepared. ### The Bigger Picture NadMesh is just one example of how attackers are evolving to target new technologies. As AI adoption grows, so does the attack surface. This botnet is a wake-up call for anyone running exposed AI services. The intel feed behind that counter is a stark reminder that the bad guys are always watching. They're scanning for weaknesses, and they're getting better at exploiting them. Don't be their next target. Secure your AI services today.