Case pickai-comfyui-backdoorAI supply chainWorldwide
Pickai backdoor spreads through ComfyUI flaws to nearly 700 AI image servers
Qi'anxin XLab tracked a C++ backdoor delivered via ComfyUI vulnerabilities that disguised itself as config files, stole AI-related data and gave reverse shells; samples were also served from commercial AI vendor Rubick.ai's site.
HighAttack on AIStatus: OngoingVerified case file
Open in the interactive mapCite this case
- Reported
- Jun 18, 2025
- Location
- Worldwide
- Target
- ComfyUI image-generation servers; Rubick.ai platform
- Severity
- High
- Triggered by
- Unknown
- Actor type
- Criminal
- Reported loss
- None reported
- CVE
- None
What happened
Qi'anxin XLab tracked a C++ backdoor delivered via ComfyUI vulnerabilities that disguised itself as config files, stole AI-related data and gave reverse shells; samples were also served from commercial AI vendor Rubick.ai's site.
Impact: At least 695 servers compromised, mainly in Germany, the United States and China; downstream risk to Rubick.ai e-commerce customers
Who triggered it
Actor: Unknown
Attribution: Unattributed; XLab traced distribution to IP 185.189.149.151 and six C2 servers and found early samples uploaded from Hong Kong
Motive: Remote access to AI infrastructure and theft of AI-related data
How it happened
Attack vector: Exploitation of several high-risk ComfyUI vulnerabilities to drop ELF executables disguised as config.json and vim.json, with systemd and init.d persistence
Root cause: Unpatched, internet-exposed ComfyUI instances; a compromised upstream AI vendor hosting the payloads
Timeline
- Early Pickai sample uploaded to VirusTotal from Hong Kong
- XLab detects ComfyUI exploitation delivering Pickai and registers an unclaimed C2 domain
- XLab notifies Rubick.ai that its site hosts Pickai payloads; no response
- China's National Cybersecurity Notification Center warns ComfyUI flaws are being exploited
- XLab publishes the Pickai report counting at least 695 infected servers
Response
XLab sinkholed one C2 domain and published IOCs; Chinese authorities issued a warning; Rubick.ai did not respond to notification
Current status: Ongoing
Sources (open in a new tab)
- Qi'anxin XLab blog.xlab.qianxin.com
- Cyber Press cyberpress.org
- SC World scworld.com
Cite this case
Pickai backdoor spreads through ComfyUI flaws to nearly 700 AI image servers. AI Threat Watch, case pickai-comfyui-backdoor, Jun 18, 2025. https://aithreat.io/cases/pickai-comfyui-backdoor/
Permanent link: https://aithreat.io/cases/pickai-comfyui-backdoor/