# NadMesh Botnet Targets AI Services Threat to cloud keys and Kubernetes tokens - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-07-17 - **Topic:** [Data & AI](https://brifing.si/c/data-ai) - **Original article:** - **On Brifing:** https://brifing.si/s/be59c4df-fe29-4da5-a353-43ebaada4e6e ## Emergence of NadMesh Botnet Emerging in early July, the NadMesh botnet scans exposed AI services to target cloud keys and Kubernetes tokens. It exploits vulnerabilities in popular AI tools like ComfyUI, Ollama, and Gradio. ## Targeted AI Services NadMesh targets locally run models and workflow builders that are quickly set up but lack timely security measures. These vulnerabilities allow the botnet to access cloud credentials. ## Theft of Cloud Credentials The botnet steals cloud keys from environment variables, Kubernetes service account tokens, and Docker configuration files. Researchers emphasize that the primary target is cloud credentials. ## Exploitation of Vulnerabilities NadMesh exploits exposed services like Docker API, Jenkins console, and Redis. These vulnerabilities enable the botnet to carry out successful attacks. ## Scanning and Rescanning Process The botnet intensively scans target subnets and rescan IP addresses with vulnerabilities. Targets that do not return results are automatically blacklisted. ## Security Measures and Outcome Effective measures against the NadMesh botnet include placing services behind authentication and closing open ports. Immediate revocation of cloud credentials is also crucial. ## Sources covering this story - https://thehackernews.com/2026/07/new-nadmesh-botnet-hunts-exposed-ai.html — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._