TL;DR: Our research team at Era uncovered Greeter, an attack framework targeting Flowise, an AI development platform with 55,000+ GitHub stars.

We deployed seven honeypots and captured 4,972 "hello" messages, each carrying malicious JavaScript through Flowise's overrideConfig parameter.

The interesting part? The malicious code never appeared in the saved workflow.

We reconstructed 4,000+ commands revealing:

• Host reconnaissance and privilege checks
• Searches for credentials, SSH keys, and secrets
• AWS, Azure, and GCP metadata probing
• Persistence attempts and fileless execution preparation

We also identified 4,372 internet-exposed Flowise instances, including 46 unauthenticated instances that appeared to match our vulnerable setup.

The bigger concern is how a compromised AI application can become an entry point into the broader cloud environment.

Full technical breakdown: https://era.security/blog/greeter-flowise-ai-infrastructure-attack