Hackers Are Attempting to Turn ComfyUI Servers Into a Cryptomining Proxy Botnet

A sophisticated threat actor is actively hijacking Internet-exposed ComfyUI servers by exploiting their custom node ecosystem to deploy persistent, fileless cryptominers and proxy bots, rapidly evolving their toolkit to evade detection, kill competitors, and ensure re-infection, all managed through a central C2 infrastructure.