An active campaign has been observed targeting
internet-exposed instances running ComfyUI, a popular stable
diffusion platform, to enlist them into a cryptocurrency mining and
proxy botnet. "A purpose-built Python scanner continuously
sweeps major cloud IP ranges for vulnerable targets, automatically
installing malicious nodes via ComfyUI-Manager if no
exploitable node is already
Read more https://thehackernews.com/2026/04/over-1000-exposed-comfyui-instances.html

