Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A new backdoor named Pickai is exploiting ComfyUI vulnerabilities to spread and steal sensitive AI data. Developed in C++, Pickai offers remote command execution and reverse shell capabilities with strong persistence and evasion techniques. It uses multiple C2 servers for redundancy and has infected nearly 700 devices globally. The malware is hosted on Rubick.ai, an AI e-commerce platform serving major brands, posing significant supply chain risks. Pickai employs various obfuscation methods, including string encryption, process disguise, and multiple persistence mechanisms. Its network communication uses a three-tier timing strategy for C2 communication and device information reporting.

Pickai is a sophisticated backdoor malware developed in C++ that exploits vulnerabilities in ComfyUI, a user interface framework used in AI applications. The malware enables remote command execution and reverse shell capabilities, allowing attackers to gain persistent and stealthy control over infected systems. Pickai employs multiple advanced evasion and persistence techniques, including string encryption to obfuscate its code, process disguise to avoid detection by security tools, and multiple mechanisms to maintain persistence across system reboots. It communicates with its command and control (C2) infrastructure using a three-tier timing strategy, which helps evade network-based detection by varying communication intervals. The malware uses multiple C2 servers for redundancy, ensuring continued control even if some servers are taken down. Notably, Pickai has infected nearly 700 devices globally and is hosted on Rubick.ai, an AI e-commerce platform that serves major brands, indicating a significant supply chain risk. This supply chain vector could allow the malware to spread widely through trusted AI software components or updates. The malware's primary objective appears to be the theft of sensitive AI data, which could include proprietary models, training data, or intellectual property. Indicators of compromise include several file hashes, IP addresses, and URLs linked to the malware’s infrastructure. Despite the lack of a specific CVE or known exploits in the wild, the malware’s capabilities and infection scale suggest a well-developed threat targeting AI ecosystems through ComfyUI vulnerabilities.

Detailed information about Beware of AI Pickpockets: Pickai Backdoor Spreading Through ComfyUI Vulnerability. Get real-time updates, technical details, and miti

Title	Severity	Type	Source	Date

Threats Tagged 'ai data theft'

Filter Threats

Threats Tagged 'ai data theft'