OpenWebUI Servers Targete
A recent campaign has targeted improperly secured Open WebUI systems, allowing threat actors to deploy malicious artificial intelligence payloads.
Open WebUI is a highly popular self-hosted interface designed to enhance large language models. Shodan scans reveal over 17,000 active instances globally, making it a lucrative target for scanning attackers.
By abusing the Open WebUI Tools plugin system, attackers injected an AI-generated Python script to download cryptominers and infostealers.
Discovered by the Sysdig Threat Research Team, attackers exploited internet-exposed systems that retained administrative privileges.
The initial access relied entirely on dangerous misconfigurations rather than a software vulnerability. Because the systems lacked authentication, unauthorized users could execute commands freely without traditional exploits, transferring victim data swiftly.
Attackers uploaded a Python script masquerading as a default Open WebUI Tool template.
This code was heavily obfuscated using PyObfuscator, a technique researchers have named pyklump.
The payload featured exactly 64 recursive layers of Base64 compression. Upon reversing the obfuscation, researchers found a script likely written with the help of artificial intelligence.
It relied heavily on inline format string variables and utilized a targeted Discord webhook for command and control operations.
On Linux systems, the attackers prioritized complete stealth and automated cryptojacking. The payload copied itself into a hidden configuration folder before downloading T-Rex and XMRig cryptominers.
To bypass network filters, the attackers routed their downloads through a proxy service. The malware mined Kawpow and Monero cryptocurrencies, routing funds to attacker-controlled wallets.
To remain hidden, the script compiled two C programs into shared objects and loaded them using the LD_PRELOAD environment variable.
The first object, processhider, hid the cryptominer from system utilities by filtering process names.
The second, argvhider, hooked the main function to erase the memory of command-line arguments, hiding sensitive mining pool details. Persistence was finally achieved by creating a disguised systemd service named ptorch_updater.
The Windows attack path demonstrated high sophistication compared to its Linux counterpart, focusing heavily on credential theft and persistent access.
The Python script downloaded the Java Development Kit alongside a malicious loader file named application-ref.jar. This loader executed secondary resource files, dropping an infostealer payload onto the system.
The malware launched a new Java process that intentionally disabled bytecode verification and monitoring mechanisms.
It targeted authentication tokens and credentials from Google Chrome extensions and the Discord desktop application.
Furthermore, the Windows variant utilized advanced sandbox evasion techniques, checking specific processor features to ensure it was not running in a virtualized analysis environment.
Securing artificial intelligence interfaces is critical as their enterprise adoption grows. This attack demonstrates how a simple misconfiguration can lead to severe compromises across both Windows and Linux operating systems.
Organizations must ensure Open WebUI instances are properly authenticated and never needlessly exposed to the public internet.
Employing robust runtime security detections is absolutely essential to identify stealthy behavior like memory manipulation and hidden cryptocurrency mining activities before they cause significant damage.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…