# Over 1,000 ComfyUI Instances Compromised in Automated Cryptomining and Proxy Botnet Offensive
A sophisticated and ongoing campaign is systematically compromising internet-exposed instances of ComfyUI—the widely-used open-source stable diffusion interface—to recruit them into a cryptocurrency mining and proxy botnet infrastructure. Security researchers have identified an automated scanning and exploitation pipeline that specifically targets poorly secured deployments, leveraging the platform's own extension ecosystem to establish persistence and execute illicit workloads at scale.
## The Threat
Threat actors have deployed a purpose-built Python-based scanner that continuously traverses major cloud IP address ranges, probing for accessible ComfyUI instances. When a vulnerable target is identified, the attacker deploys custom malicious nodes through ComfyUI-Manager—the platform's legitimate package management system—effectively weaponizing the application's own extension architecture. Once infected, a compromised instance becomes dual-purpose infrastructure: it participates in a distributed cryptocurrency mining pool while simultaneously functioning as a proxy node within the attacker's broader botnet.
The scale of the current operation is substantial. Researchers tracking the campaign have documented over 1,000 distinct instances that have been successfully enrolled into the malicious infrastructure. The use of cloud-hosted deployments suggests the attackers are targeting organizations and researchers running ComfyUI on managed infrastructure, potentially maximizing their ability to offload computational costs onto victims' infrastructure budgets.
## Background and Context
ComfyUI has become a central tool in the generative AI ecosystem. The application provides a node-based interface for running Stable Diffusion and other image generation models, making sophisticated AI workflows accessible to researchers, artists, and developers without requiring deep machine learning expertise. Its popularity has grown substantially as the demand for accessible AI image generation tools has surged.
Like many developer-focused tools with open-source DNA, ComfyUI prioritizes extensibility over default security hardening. The ComfyUI-Manager extension—designed to simplify the installation of additional nodes and models—allows users to download and execute arbitrary Python code from remote repositories. While this flexibility is a feature for legitimate users seeking to expand functionality, it becomes a significant liability when an instance is exposed to the internet without proper authentication controls or network segmentation.
The targeting of ComfyUI specifically is not coincidental. The platform's infrastructure footprint is ideal for the attacker's purposes: compute-intensive (making it profitable for cryptomining), widely deployed in cloud environments, and often operated by technical users who may be focused on functionality rather than hardening basic security posture. Many instances are deployed with default configurations that assume they will operate only within private networks, leaving them vulnerable when accidentally exposed.
## Technical Details
The attack chain follows a logical progression:
Reconnaissance: The threat actor's scanner probes public IP ranges associated with major cloud providers—AWS, Google Cloud, Azure—testing for accessible ComfyUI web interfaces. The scanner likely identifies the service by its distinctive UI or API endpoints.
Exploitation: Once a target is identified, the attacker interacts with the ComfyUI-Manager API to install custom nodes. If the instance lacks authentication, this interaction succeeds without friction. The malicious nodes are hosted on attacker-controlled repositories, making the installation seamless from a user perspective but delivering weaponized code.
Persistence and Execution: The installed nodes establish persistence by embedding themselves into the workflow execution pipeline. Every time the compromised ComfyUI instance processes an image generation request—or even when left idle—the malicious node executes background processes for cryptomining or proxy operations.
Command and Control: The compromised instance communicates with the attacker's command infrastructure to receive mining pool assignments or proxy traffic instructions. This communication is likely obfuscated or conducted over encrypted channels to avoid detection by network monitoring systems.
The sophistication of this approach—automating the scan, exploit, and node installation cycle—suggests the attacker has invested engineering effort into fully autonomous operation. Minimal human intervention is likely required to manage a botnet of this scale.
## Implications
The compromise of over 1,000 ComfyUI instances creates several downstream risks:
Resource Theft: Each compromised instance represents stolen computational capacity. For organizations running ComfyUI on cloud infrastructure, this translates directly to inflated cloud bills. The attacker essentially benefits from victims' infrastructure spending.
Network Compromise: Instances recruited into a proxy botnet can be used to route traffic, facilitate lateral movement, or conduct attacks that mask the attacker's true origin. Organizations whose compromised systems serve as proxy nodes may inadvertently facilitate attacks against third parties.
Supply Chain Concerns: If any infected ComfyUI instance is used to generate training data, model checkpoints, or other AI artifacts, those outputs may be subtly compromised. The full extent of downstream taint is difficult to assess.
Reputational Risk: Organizations that discover compromised ComfyUI instances in their infrastructure face the dual problem of handling the incident internally while potentially explaining to users how their systems were leveraged.
## Recommendations
Organizations operating internet-accessible ComfyUI instances should prioritize the following:
## HackWire Analysis
This campaign highlights a recurring pattern in cloud security: tools designed for developer convenience and extensibility become attack surface when deployed without security defaults. ComfyUI's node-based architecture and package manager are strengths for legitimate users—but they are also precisely the mechanisms that make automated compromise so effective.
The targeting of AI infrastructure specifically is noteworthy. As AI tools proliferate and organizations increasingly operate them at scale, threat actors are recognizing the value of AI-adjacent infrastructure as both a direct attack target and a launchpad for broader botnet operations. Unlike traditional compute resources, GPU-equipped AI systems are increasingly valuable for cryptomining, creating strong economic incentives for compromise.
The fact that over 1,000 instances have already been successfully recruited suggests this campaign has been running undetected for some time. Organizations may discover their own compromises only through elevated cloud bills or security investigations triggered by other alerts. The automated nature of the scanning and exploitation pipeline means the attacker can scale operations with minimal additional effort—a troubling dynamic that will likely persist until the broader ecosystem emphasizes security defaults over convenience assumptions.