Case open-webui-sysdig-cryptojackingLLMjackingWorldwide
Exposed Open WebUI instance hijacked to run AI-generated cryptominer and infostealer
Sysdig observed an attacker abuse an Open WebUI server exposed with admin rights and no login, uploading an obfuscated, partly AI-written Python Tool that deployed XMRig and T-Rex miners on Linux and Java infostealers on Windows.
HighAttack on AIStatus: ContainedVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 2, 2025
- Location
- Worldwide
- Target
- Internet-exposed Open WebUI deployment
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Sysdig observed an attacker abuse an Open WebUI server exposed with admin rights and no login, uploading an obfuscated, partly AI-written Python Tool that deployed XMRig and T-Rex miners on Linux and Java infostealers on Windows.
Impact: Compromised host mined Monero and Kawpow with hidden processes and systemd persistence; Windows stage stole Chrome extension data and Discord tokens with sandbox evasion
Who triggered it
Actor: Unknown
Attribution: Unattributed; Sysdig judged the Python payload mostly AI-generated with some human-written parts and noted Discord webhook C2
Motive: Cryptomining and credential theft on compromised infrastructure
How it happened
Attack vector: Open WebUI Tools plugin feature used to upload and execute a Python script obfuscated through 64 layers of reversed compressed base64
Root cause: Self-hosted AI interface exposed to the internet with administrator privileges and authentication disabled
Timeline
- Sysdig runtime detections flag miner traffic and LD_PRELOAD process hiding on a customer training system
- Sysdig publishes the investigation of the AI-generated payload
- Wiz adds the case to its cloud threat landscape as an Open WebUI cryptojacking incident
Response
Detected at runtime via YARA and behavioral rules; Sysdig advised keeping AI interfaces off the public internet and enforcing authentication
Current status: Contained
Sources (open in a new tab)
- Sysdig sysdig.com
- Wiz Cloud Threat Landscape threats.wiz.io
Cite this case
Exposed Open WebUI instance hijacked to run AI-generated cryptominer and infostealer. AI Threat Watch, case open-webui-sysdig-cryptojacking, Jun 2, 2025. https://aithreat.io/cases/open-webui-sysdig-cryptojacking/
Permanent link: https://aithreat.io/cases/open-webui-sysdig-cryptojacking/