New CAI cloud worm targets developer infrastructure, removes rival malware, and deploys miners

Security researchers say a new cloud-focused worm is spreading through developer and container environments, stealing credentials, mining cryptocurrency, and removing competing malware from infected systems.

The threat, tracked as Cloud AI Infrastructure Attack Framework, or CAI, appears to be built as a centralized botnet aimed at cloud-native services including Docker, Kubernetes, Redis, etcd, Kubelet, and Ray. Researchers say it uses automated scanning and exploitation workflows to find exposed systems, then pushes additional payloads after gaining access.

According to researchers, CAI does more than quietly harvest secrets. It also searches for and terminates processes associated with other credential-stealing worms, including TeamPCP and PCPJack. That behavior suggests the operators are trying to reduce competition on compromised infrastructure and keep control over infected hosts for themselves.

Hunt.io researcher Michael Rippey said the first signs of CAI were observed on June 15, when the company found open directories tied to the operator. Over the following weeks, the activity reportedly moved from test code into active deployments. Rippey said the campaign shows signs of iterative development and may have been assisted by large language models, based on coding style and comments in the scripts.

Security researchers say the current CAI toolkit delivers three main payloads to compromised systems:

• cryptocurrency miners
• credential-stealing components
• a Python backdoor for continued access

Command-and-control logs reportedly indicate active exploitation attempts and successful compromises, with wallet activity linked to the operation. While the malware is not described as highly advanced, researchers say it is effective and built for persistence in cloud environments where exposed developer tools can provide broad access.

CAI appears to reflect a wider trend in which threat actors increasingly target each other’s infrastructure as well as victims’ cloud services. Analysts warn that the rise of competing worms and supply-chain attacks means developers and defenders should closely monitor exposed services, limit unnecessary access, and watch for signs of unauthorized process termination or unexpected mining activity.