A sophisticated malware campaign targeting ComfyUI, a popular AI image generation framework, has successfully compromised at least 695 servers worldwide, security researchers have discovered.

The attack represents a significant escalation in threats against AI infrastructure, exploiting vulnerabilities in ComfyUI to deploy a lightweight but highly persistent backdoor dubbed “Pickai.”

The campaign first emerged in February 2025 when an early version of the malware was uploaded to VirusTotal from Hong Kong, but the full scope of the operation became apparent in March when suspicious activity was detected across multiple geographic regions.

The attackers have demonstrated remarkable persistence and sophistication, utilizing compromised infrastructure including the official website of Rubick.ai, a commercial AI platform serving over 200 major retail brands including Amazon, Myntra, and Hudson Bay.

XLab analysts identified the malware through their Cyber Threat Insight and Analysis System on March 17, 2025, when they flagged suspicious behavior from IP address 185.189.149.151.

The researchers discovered that attackers were leveraging ComfyUI vulnerabilities to distribute ELF executables disguised as configuration files, including config.json, tmux.conf, and vim.json.

The malware’s name “Pickai” reflects its core functionality of stealing sensitive AI-related data, operating as a digital pickpocket within AI development environments.

The global impact of this campaign extends far beyond individual server compromises, with infected systems concentrated primarily in Germany, the United States, and China.

Security researchers obtained partial visibility into the botnet by registering an unclaimed command-and-control domain, revealing traffic spikes exceeding 400 daily active installations during periods when primary C2 servers failed.

Advanced Persistence Mechanisms Ensure Long-Term Compromise

The Pickai malware employs an unusually robust persistence strategy that sets it apart from conventional backdoors.

When operating with root privileges, the malware creates five separate copies of itself across different system directories, each with synchronized modification timestamps matching /bin/sh to blend with legitimate system files.

These copies are strategically placed in locations such as /usr/bin/auditlogd, /usr/sbin/hwstats, /sbin/dmesglog, /var/lib/autoupd, and /var/run/healthmon, masquerading as legitimate system services.

Each copy implements dual persistence mechanisms using both init.d and system service frameworks, creating a total of ten different services for root-level infections.

The malware deliberately appends random data to each file copy, ensuring that hash-based detection systems encounter different MD5 signatures for what is essentially the same malicious payload.

For non-root users, Pickai maintains five persistence points using systemd services in user-space directories, demonstrating its adaptability across different privilege levels.

This redundant approach means that incomplete removal attempts will trigger automatic reinfection, making the malware particularly challenging to eradicate from compromised systems.

Are you from SOC/DFIR Teams! - Interact with malware in the sandbox and find related IOCs. - Request 14-day free trial

The post Hackers Exploit ComfyUI 700+ AI Image Generation Servers to Deploy Malware appeared first on Cyber Security News.