NadMesh Uses Shodan to Find and Hijack Exposed AI and MCP Infrastructure

A sharp structural shift has been identified in the botnet landscape. Security researchers at XLab have uncovered NadMesh, a Go-based botnet that has been spreading rapidly since early July 2026. This malware marks a distinct evolution from opportunistic worm behavior toward an industrial-grade, ROI-driven attack platform aimed squarely at Artificial Intelligence (AI) and Model Context Protocol (MCP) infrastructure. Unlike traditional worms that spread indiscriminately, NadMesh combines autonomous scanning, over 20 unique exploitation vectors, and Shodan-powered intelligence harvesting into a single closed-loop system its operator refers to as the “n4d mesh controller”. NadMesh Uses Shodan to Find and Hijack Exposed...

Read the full article at the source.