NadMesh Botnet Is Quietly Raiding Unprotected AI Servers for Cloud Keys

Key points

• A botnet called NadMesh appeared in early July 2026 and specifically hunts for exposed AI services on the public internet.
• The operator's own dashboard claims 3,811 unique Amazon Web Services access keys collected so far.
• NadMesh targets six popular AI tools that teams often set up quickly and forget to lock down: ComfyUI, Ollama, n8n, Open WebUI, Langflow, and Gradio.
• The botnet uses Shodan, a search engine that indexes internet-connected devices, to keep finding fresh targets.

There's a new botnet crawling the internet, and it's picking on a very specific victim: the AI server your team spun up last month and forgot about.

NadMesh is written in Go, a programming language popular with modern malware authors because it compiles into fast, portable files. It surfaced in early July 2026, first reported by The Hacker News. A botnet, for readers who haven't met one, is a network of hacked machines a single operator controls remotely.

What makes NadMesh interesting is what it hunts.

What is NadMesh actually looking for?

AI tools that companies put on the internet without a password, or with a weak one. The operator uses Shodan, basically Google for internet-connected servers, to keep a rolling list of targets.

The shopping list is specific. ComfyUI and Gradio are interfaces for running image generators and machine-learning demos. Ollama and Open WebUI let teams run large language models on their own hardware. N8n and Langflow are workflow builders that string AI services together with other business tools.

All six are the sort of software a data scientist installs in an afternoon. Powerful, and frequently left wide open, because whoever set them up assumed nobody would find the server.

Somebody found the server.

Why do the hackers want AI servers?

Because of what's stored on them. These tools often hold API keys, digital passwords that let software talk to cloud services on your behalf.

NadMesh's own control panel, which researchers were able to examine, claims 3,811 unique AWS access keys harvested. A stolen AWS key can be used to spin up expensive servers on the victim's bill, usually to mine cryptocurrency, or to quietly copy data out of cloud storage. The botnet also grabs Kubernetes tokens. Kubernetes is the software that orchestrates cloud applications at scale, and its tokens are the equivalent of handing someone the keys to the whole server farm. We reported on 1 July 2026 how an unauthenticated flaw in Argo CD's repo-server showed just how quickly a single compromised Kubernetes credential can escalate.

Strip away the branding and this isn't a novel AI attack. It's credential theft, the same web-security primitive that has been draining cloud accounts for a decade. The twist is that AI tools have become the softest target, because they get deployed by teams focused on the model, not the firewall. Our 8 July 2026 story on how a single attacker wrecked an AWS account in 72 hours shows what happens once those credentials land in the wrong hands.

Should you worry if your company runs any of these tools?

Check whether any of them are reachable from the open internet. If they are, put them behind a VPN or your company's single sign-on system today.

Rotate any API keys or tokens stored inside those tools. If the service was exposed for any length of time, treat the credentials on it as burned.

Ordinary customers don't need to act here. But if you use a product from a small company that leans heavily on AI and you start seeing strange charges or account activity, this is one of the reasons why.