The recently discovered cloud-focused VoidLink malware framework is believed to have been developed by a single person with the help of an artificial intelligence model.
VoidLink cloud malware shows clear signs of being AI-generated
The recently discovered cloud-focused VoidLink malware framework is believed to have been developed by a single person with the help of an artificial intelligence model.
www.bleepingcomputer.com
January 20, 2026 at 7:35 PM
The recently discovered cloud-focused VoidLink malware framework is believed to have been developed by a single person with the help of an artificial intelligence model.
Elastic's security team has come across "a data dump containing source code, compiled binaries, and deployment scripts for the kernel rootkit components of VoidLink, a cloud-native Linux malware framework first documented by Check Point Research in January 2026."
www.elastic.co/security-lab...
www.elastic.co/security-lab...
Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework — Elastic Security Labs
Elastic Security Labs analyzes VoidLink, a sophisticated Linux malware framework that combines traditional Loadable Kernel Modules with eBPF to maintain persistence.
www.elastic.co
March 26, 2026 at 6:08 PM
Elastic's security team has come across "a data dump containing source code, compiled binaries, and deployment scripts for the kernel rootkit components of VoidLink, a cloud-native Linux malware framework first documented by Check Point Research in January 2026."
www.elastic.co/security-lab...
www.elastic.co/security-lab...
Three Linux rootkits use eBPF to blind ss, netstat, bpftool - and kill your debugger before it attaches. https://intel.threadlinqs.com/threat/TL-2026-2624 #ThreatIntel #CVE_2024_23897 #LinkPro #VoidLink
September 23, 2026 at 2:23 AM
Three Linux rootkits use eBPF to blind ss, netstat, bpftool - and kill your debugger before it attaches. https://intel.threadlinqs.com/threat/TL-2026-2624 #ThreatIntel #CVE_2024_23897 #LinkPro #VoidLink
It features more than 30 modules that can be used to customize capabilities to meet attackers’ needs for each infected machine.
Never-before-seen Linux malware is “far more advanced than typical”
VoidLink includes an unusually broad and advanced array of capabilities.
arstechnica.com
January 14, 2026 at 7:24 PM
It features more than 30 modules that can be used to customize capabilities to meet attackers’ needs for each infected machine.
A newly discovered advanced cloud-native Linux malware framework named VoidLink focuses on cloud environments, providing attackers with custom loaders, implants, rootkits, and plugins designed for modern infrastructures.
New VoidLink malware framework targets Linux cloud servers
A newly discovered advanced cloud-native Linux malware framework named VoidLink focuses on cloud environments, providing attackers with custom loaders, implants, rootkits, and plugins designed for modern infrastructures.
www.bleepingcomputer.com
January 13, 2026 at 10:12 PM
A newly discovered advanced cloud-native Linux malware framework named VoidLink focuses on cloud environments, providing attackers with custom loaders, implants, rootkits, and plugins designed for modern infrastructures.
Remember VoidLink, the cloud-targeting Linux malware? An AI agent wrote it
Remember VoidLink, the cloud-targeting Linux malware? An AI agent wrote it
AI + skilled malware developers = security threat
VoidLink, the newly spotted Linux malware that targets victims' clouds with 37 evil plugins, was generated "almost entirely by artificial intelligence" and likely developed by just one person, according to the research team that discovered the do-it-all implant.…
dlvr.it
January 20, 2026 at 6:51 PM
Remember VoidLink, the cloud-targeting Linux malware? An AI agent wrote it
AI pomohla vytvořit 88 tisíc řádků Linuxového malwaru VoidLink www.root.cz/zpravicky/ai...
AI pomohla vytvořit 88 tisíc řádků Linuxového malwaru VoidLink - Root.cz
Výzkumníci ze společnosti Check Point Research odhalili pokročilý Linuxový malware s názvem VoidLink, jehož 88 000 řádků kódu vytvořila AI. Framework…
www.root.cz
January 21, 2026 at 10:21 PM
AI pomohla vytvořit 88 tisíc řádků Linuxového malwaru VoidLink www.root.cz/zpravicky/ai...
VoidLink: The Cloud-Native Malware Turning Linux into an Attack SaaS
VoidLink: The Cloud-Native Malware Turning Linux into an Attack SaaS
Check Point Research discovered VoidLink in December 2025, a cloud-native Linux malware framework written in Zig with 30-plus plugins, multiple rootkits, and automatic adaptation to major cloud providers.
deafnews.it
August 8, 2026 at 3:05 AM
VoidLink: The Cloud-Native Malware Turning Linux into an Attack SaaS
VoidLink, the recently discovered malware which targets Linux-based cloud servers, was likely almost entirely generated by AI, researchers at have said. 👀
(With help from prompts and guidance by one nefarious developer, that it is...)
www.infosecurity-magazine.com/news/voidlin...
(With help from prompts and guidance by one nefarious developer, that it is...)
www.infosecurity-magazine.com/news/voidlin...
VoidLink Linux Malware Was Built Using an AI Agent, Researchers Reveal
Sophisticated malware previously thought to be the work of a well-resourced cyber-crime group was built by one person - with the aid of AI tools
www.infosecurity-magazine.com
January 21, 2026 at 1:05 PM
VoidLink, the recently discovered malware which targets Linux-based cloud servers, was likely almost entirely generated by AI, researchers at have said. 👀
(With help from prompts and guidance by one nefarious developer, that it is...)
www.infosecurity-magazine.com/news/voidlin...
(With help from prompts and guidance by one nefarious developer, that it is...)
www.infosecurity-magazine.com/news/voidlin...
New Linux malware targets the cloud, steals creds, and then vanishes
New Linux malware targets the cloud, steals creds, and then vanishes
Cloud-native, 37 plugins … an attacker's dream
A brand-new Linux malware named VoidLink targets victims' cloud infrastructure with more than 30 plugins that allow attackers to perform a range of illicit activities, from silent reconnaissance and credential theft to lateral movement and container abuse. …
dlvr.it
January 14, 2026 at 8:44 PM
New Linux malware targets the cloud, steals creds, and then vanishes
Ooh baby you know I love an eBPF rootkit breakdown.
Illuminating VoidLink: Technical analysis of the VoidLink rootkit framework — Elastic Security Labs
Elastic Security Labs analyzes VoidLink, a sophisticated Linux malware framework that combines traditional Loadable Kernel Modules with eBPF to maintain persistence.
www.elastic.co
March 25, 2026 at 9:01 PM
Ooh baby you know I love an eBPF rootkit breakdown.
⚠️ VOIDLINK rootkit evolves stealth tactics
VOIDLINK is a stealthy Windows rootkit abusing kernel drivers to hide processes, files and registry keys. It uses persistence, anti-forensics and evasion to maintain long-term access, complicating detection and incident response.
#ransomNews #rootkit
VOIDLINK is a stealthy Windows rootkit abusing kernel drivers to hide processes, files and registry keys. It uses persistence, anti-forensics and evasion to maintain long-term access, complicating detection and incident response.
#ransomNews #rootkit
January 20, 2026 at 10:37 AM
⚠️ VOIDLINK rootkit evolves stealth tactics
VOIDLINK is a stealthy Windows rootkit abusing kernel drivers to hide processes, files and registry keys. It uses persistence, anti-forensics and evasion to maintain long-term access, complicating detection and incident response.
#ransomNews #rootkit
VOIDLINK is a stealthy Windows rootkit abusing kernel drivers to hide processes, files and registry keys. It uses persistence, anti-forensics and evasion to maintain long-term access, complicating detection and incident response.
#ransomNews #rootkit
Loving this Never Enough #AIvideo. Does this explain our constant striving for more?
Your Brain Is Broken On Purpose
YouTube video by VOIDLINK
www.youtube.com
June 25, 2025 at 4:36 PM
Loving this Never Enough #AIvideo. Does this explain our constant striving for more?
Attackers focus on machine identities: VoidLink, LangFlow and ShadowRay leverage stolen keys and unmanaged AI agents. SPIFFE/SPIRE help with short-lived workload credentials, but AI agents often still use static API keys. #machineidentity #SPIFFE #VoidLink https://bit.ly/47XTOBj
March 20, 2026 at 4:58 PM
Attackers focus on machine identities: VoidLink, LangFlow and ShadowRay leverage stolen keys and unmanaged AI agents. SPIFFE/SPIRE help with short-lived workload credentials, but AI agents often still use static API keys. #machineidentity #SPIFFE #VoidLink https://bit.ly/47XTOBj
-Victim wants its ransom back from Qakbot admin
-New scam compound investigation in Cambodia
-Belarus arrests HAM radio operators for treason
-Infoblox hacks push spam network
-New Mamba PhaaS
-VoidLink created using AI
-Iranian hackers switch to Starlink during outage
-Glibc patches 30yo bug
-New scam compound investigation in Cambodia
-Belarus arrests HAM radio operators for treason
-Infoblox hacks push spam network
-New Mamba PhaaS
-VoidLink created using AI
-Iranian hackers switch to Starlink during outage
-Glibc patches 30yo bug
January 21, 2026 at 9:06 AM
-Victim wants its ransom back from Qakbot admin
-New scam compound investigation in Cambodia
-Belarus arrests HAM radio operators for treason
-Infoblox hacks push spam network
-New Mamba PhaaS
-VoidLink created using AI
-Iranian hackers switch to Starlink during outage
-Glibc patches 30yo bug
-New scam compound investigation in Cambodia
-Belarus arrests HAM radio operators for treason
-Infoblox hacks push spam network
-New Mamba PhaaS
-VoidLink created using AI
-Iranian hackers switch to Starlink during outage
-Glibc patches 30yo bug
🚨 VoidLink Malware – Cloud Security Threat
VoidLink is a newly identified Linux malware framework built for cloud & container environments like Docker and Kubernetes, using stealth tactics to stay hidden.
#CloudSecurity #CyberThreats #LinuxSecurity #ContainerSecurity #Technijian
VoidLink is a newly identified Linux malware framework built for cloud & container environments like Docker and Kubernetes, using stealth tactics to stay hidden.
#CloudSecurity #CyberThreats #LinuxSecurity #ContainerSecurity #Technijian
January 14, 2026 at 10:45 AM
🚨 VoidLink Malware – Cloud Security Threat
VoidLink is a newly identified Linux malware framework built for cloud & container environments like Docker and Kubernetes, using stealth tactics to stay hidden.
#CloudSecurity #CyberThreats #LinuxSecurity #ContainerSecurity #Technijian
VoidLink is a newly identified Linux malware framework built for cloud & container environments like Docker and Kubernetes, using stealth tactics to stay hidden.
#CloudSecurity #CyberThreats #LinuxSecurity #ContainerSecurity #Technijian
-Firefox 147 is out
-Apple picks Gemini for Siri's AI
-Patch Tuesday is out
-SpyX stalkerware traced back to China
-Stormous ransomware "alliance" crumbles
-Malware reports on VoidLink, CastleLoader, AsyncRAT
-APT reports on UAC-0190, Contagious Interview
-ConnectPOS had a credential leak
-Apple picks Gemini for Siri's AI
-Patch Tuesday is out
-SpyX stalkerware traced back to China
-Stormous ransomware "alliance" crumbles
-Malware reports on VoidLink, CastleLoader, AsyncRAT
-APT reports on UAC-0190, Contagious Interview
-ConnectPOS had a credential leak
January 14, 2026 at 9:54 AM
-Firefox 147 is out
-Apple picks Gemini for Siri's AI
-Patch Tuesday is out
-SpyX stalkerware traced back to China
-Stormous ransomware "alliance" crumbles
-Malware reports on VoidLink, CastleLoader, AsyncRAT
-APT reports on UAC-0190, Contagious Interview
-ConnectPOS had a credential leak
-Apple picks Gemini for Siri's AI
-Patch Tuesday is out
-SpyX stalkerware traced back to China
-Stormous ransomware "alliance" crumbles
-Malware reports on VoidLink, CastleLoader, AsyncRAT
-APT reports on UAC-0190, Contagious Interview
-ConnectPOS had a credential leak
The Hacker Newss - Article
"VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code"...
thehackernews.com/2026/01/void...
==========================
#librecanada #linux #opensource
"VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code"...
thehackernews.com/2026/01/void...
==========================
#librecanada #linux #opensource
VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code
Experts say the VoidLink Linux malware was largely built using AI, reaching 88,000 lines of code in days and highlighting faster malware development.
thehackernews.com
January 27, 2026 at 12:40 PM
The Hacker Newss - Article
"VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code"...
thehackernews.com/2026/01/void...
==========================
#librecanada #linux #opensource
"VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code"...
thehackernews.com/2026/01/void...
==========================
#librecanada #linux #opensource
CP - Article
"Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework" ...
research.checkpoint.com/2026/voidlin...
.
==========================
#librecanada #linux #opensource
"Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework" ...
research.checkpoint.com/2026/voidlin...
.
==========================
#librecanada #linux #opensource
VoidLink: The Cloud-Native Malware Framework
The new framework maintains long-term access to Linux systems while operating reliably in cloud and container environments
research.checkpoint.com
January 16, 2026 at 3:10 AM
CP - Article
"Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework" ...
research.checkpoint.com/2026/voidlin...
.
==========================
#librecanada #linux #opensource
"Unveiling VoidLink – A Stealthy, Cloud-Native Linux Malware Framework" ...
research.checkpoint.com/2026/voidlin...
.
==========================
#librecanada #linux #opensource
A newly discovered advanced cloud-native Linux malware framework named VoidLink focuses on cloud environments, providing attackers with custom loaders, implants, rootkits, and plugins designed for modern infrastructures... 🔥🕵️♂️🧱💼🩲
#news #technews #linux
www.bleepingcomputer.com/news/securit...
#news #technews #linux
www.bleepingcomputer.com/news/securit...
New VoidLink malware framework targets Linux cloud servers
A newly discovered advanced cloud-native Linux malware framework named VoidLink focuses on cloud environments, providing attackers with custom loaders, implants, rootkits, and plugins designed for mod...
www.bleepingcomputer.com
January 14, 2026 at 7:46 AM
A newly discovered advanced cloud-native Linux malware framework named VoidLink focuses on cloud environments, providing attackers with custom loaders, implants, rootkits, and plugins designed for modern infrastructures... 🔥🕵️♂️🧱💼🩲
#news #technews #linux
www.bleepingcomputer.com/news/securit...
#news #technews #linux
www.bleepingcomputer.com/news/securit...
January 17, 2026 at 4:15 PM
#100DaysofYARA Day 14
Checkpoint published research on VoidLink C2 framework.
They call it "advanced malware framework"; but maybe I'm not sure what "advanced" means in this context.
Rule at end
1/2
Checkpoint published research on VoidLink C2 framework.
They call it "advanced malware framework"; but maybe I'm not sure what "advanced" means in this context.
Rule at end
1/2
January 17, 2026 at 3:13 PM
#100DaysofYARA Day 14
Checkpoint published research on VoidLink C2 framework.
They call it "advanced malware framework"; but maybe I'm not sure what "advanced" means in this context.
Rule at end
1/2
Checkpoint published research on VoidLink C2 framework.
They call it "advanced malware framework"; but maybe I'm not sure what "advanced" means in this context.
Rule at end
1/2