Security researchers have identified an active and widespread campaign targeting publicly accessible instances of ComfyUI. This popular graphical user interface for Stable Diffusion AI image generation is being exploited to create a large-scale botnet for cryptocurrency mining and proxy relay services.

The attackers are employing a purpose-built Python scanner to conduct continuous sweeps of major cloud internet protocol (IP) address ranges. This automated tool searches for vulnerable targets that are exposed to the public internet without adequate security controls.

Attack Methodology and Initial Compromise

When the scanner identifies a susceptible ComfyUI instance, it proceeds to install malicious nodes automatically. This installation leverages the ComfyUI-Manager, a legitimate extension manager for the platform, to deploy the malicious payload. The attack specifically targets systems where no exploitable node is already present, indicating a methodical approach to maximizing the botnet’s reach.

The campaign’s primary objective is the illicit mining of cryptocurrency, a process that consumes significant computational resources. By co-opting the graphics processing units (GPUs) typically used for AI image rendering, the attackers generate digital currency for their own profit at the expense of the victim’s electricity and hardware wear.

Additionally, the compromised systems are enrolled into a proxy botnet. This network of hijacked machines can be used to anonymize other malicious traffic, conduct credential stuffing attacks, or serve as intermediaries for further cybercrime operations.

Understanding the Vulnerability and Target

ComfyUI itself is not inherently vulnerable; the security issue stems from improper deployment and configuration. Many users, including developers and AI enthusiasts, install the software on cloud servers or local machines and inadvertently expose its web interface directly to the internet without implementing access controls, firewalls, or authentication.

This common misconfiguration creates an open door for automated attacks. The interface, designed for local use, becomes a readily available endpoint for scanning and exploitation tools. The campaign highlights a recurring theme in cybersecurity: powerful tools deployed for convenience often lack the default security posture required for an internet-facing service.

The scale, exceeding one thousand compromised instances, underscores both the popularity of ComfyUI and the prevalence of insecure deployments. Cloud-based virtual machines with powerful GPUs are a particularly attractive target for cryptojacking due to their high-performance hardware.

Broader Implications for AI Tool Security

This incident is part of a larger trend where emerging AI and machine learning platforms become targets for resource theft. The computational power required for generative AI is valuable to both legitimate users and malicious actors. As these tools become more accessible, their security often lags behind their functionality.

The use of the ComfyUI-Manager for payload delivery is also significant. It represents a form of supply chain attack within the ecosystem, where a trusted component is used as a vector for malware. This tactic can bypass rudimentary security checks that might flag a direct external download.

For organizations and individuals running similar software, the campaign serves as a critical reminder. Any service with an internet-accessible API or web interface must be secured with strong authentication, network segmentation, and regular updates. Relying on obscurity is an ineffective defense against automated, sweeping scans.

Response and Mitigation Strategies

Affected users must immediately isolate compromised systems from networks. A full reinstallation of the operating system and software is recommended, as botnet malware often establishes persistence mechanisms. Credentials used on affected machines should be considered potentially exposed and reset.

To prevent such exploitation, security best practices must be followed. ComfyUI instances should not be exposed to the public internet. If remote access is necessary, it should be routed through a virtual private network (VPN) or secured with robust, multi-factor authentication. Regular audits of cloud security groups and firewall rules are essential to ensure only authorized services are accessible.

Monitoring for unusual system activity, such as sustained high GPU or central processing unit (CPU) usage when the system is idle, can provide an early indication of cryptomining malware. Network traffic to unknown external IP addresses may also signal participation in a proxy botnet.

Security teams monitoring cloud environments are advised to look for the distinctive scanning patterns associated with this campaign. The focused scanning of cloud IP ranges for specific service ports can be a key detection signature.

Looking Ahead: Securing the AI Development Landscape

As the investigation continues, security analysts expect the attackers to refine their techniques and potentially expand their target list to other AI workflow tools. The economic incentive for cryptojacking remains high, ensuring that poorly secured computational resources will continue to attract malicious attention.

Official guidance from the maintainers of ComfyUI and similar projects is anticipated. This will likely include more prominent warnings about the dangers of internet exposure and detailed hardening guides. The cybersecurity community may also develop specialized detection rules for network and host-based intrusion detection systems to identify this specific botnet’s activity.

The long-term solution requires a cultural shift where security is integrated into the deployment process for powerful AI tools by default. Until then, incidents like this campaign against ComfyUI will serve as costly reminders of the risks inherent in connecting powerful, unsecured software to the global internet.