AI-as-a-Service Botnet Routes Malicious Workloads Across Compromised Windows and Linux Hosts

The underground advertisement for the so-called Mycelium Framework reads like another feature‑packed botnet sales pitch: cross‑platform payloads, encrypted C2, persistence, exploit modules, credential theft, and lateral movement.

Those building blocks are not new. What makes Mycelium notable is its advertised purpose to treat compromised endpoints not as disposable bots but as a capability‑aware.

AI compute platform that dynamically routes workloads (inference, cracking, reconnaissance, exploit development, and social engineering) to nodes based on CPU, GPU, local models, stolen API keys, browser sessions, and enterprise credentials.

The post positions Mycelium as an AI‑as‑a‑Service (AIaaS) botnet. Architecturally, it claims a production‑grade C++ core with native Windows and Linux paths, pluginized modules for AI, browser forensics, exploitation, grid computing, and kernel/rootkit components.

An IRC‑based encrypted command‑and‑control channel surfaces as the operator interface for node orchestration, module deployment, AI tasking, worm control, scanning, cracking, and data exfiltration.

While the author provided no source code or proof‑of‑execution, nearly every individual capability remote exploitation, persistence, browser credential harvesting, defense evasion, SSH/SMB lateral movement, and distributed task scheduling has prior precedent in malware campaigns, making the combined concept technically credible.

The innovation is capability‑aware task routing. Mycelium’s “Mind Collective” and NetGrid subsystems are described as scheduler and job manager: nodes are profiled for available resources (GPU presence, local LLMs like Llama/Ollama, stolen GPT‑class API keys, active browser sessions) and assigned work per tier.

Flare Researchers said that, Mycelium framework is the first underground offering we have observed that explicitly positions a botnet as an AI-as-a-Service platform rather than simply a tool for DDoS, spam, ransomware deployment, or credential theft.

AI-as-a-Service Botnet

High‑value nodes with valid API keys or local high‑capacity models would receive premium tasks (executive targeting, high‑fidelity content generation).

The Windows side references WinAPI and COM interfaces, while the Linux side references POSIX and syscall-oriented design.

Lower‑capability hosts would handle preprocessing, reconnaissance, or password cracking via distributed HashGrid. This mirrors legitimate distributed computing systems resource governance, failover, retries, and dynamic module loading repurposed for malicious objectives.

The advertisement’s AI use cases underscore risk escalation. A social‑engineering engine that leverages harvested email/chat history and local context to craft personalized messages, then dispatches them through compromised Slack/Discord/Telegram sessions, raises phishing scale and efficacy.

Claims of an autonomous exploit pipeline that scrapes CVE sources, uses LLMs to generate exploit code, validates and distributes compiled modules back into the grid, outline a potentially automated offensive lifecycle that accelerates vulnerability weaponization.

The post also references “neural propagation” embedding poisoned prompts into code or document to influence downstream AI assistants an emerging vector for model manipulation.

From a defender’s lens, Mycelium real or aspirational reframes the value of compromised infrastructure. Instead of one‑off monetization, operators could derive ongoing value by leasing compute, API access, and authenticated sessions.

Hunting priorities should therefore extend beyond classic indicators: trace use and exfiltration of AI API keys, baseline CPU/GPU telemetry for anomalous inference workloads, detection of sustained encrypted outbound tasking, correlation of browser‑artifact theft with cloud/AI access.

Even if parts of the Mycelium post are marketing hyperbole, the individual techniques are observed in the wild; their integration into an AIaaS botnet is plausible and likely to appear in future campaigns.

Stop Accepting SLAs Written for 2019 SOCs – Here’s the 2026 AI SLA Vendor Checklist – Download Free AI SOC SLA Guide