Complex VoidLink Linux Malware Created by AI

VoidLink is an advanced cloud-first malware framework targeting Linux systems that researchers say was created almost entirely by artificial intelligence. It comprises custom loaders, implants, rootkits, and modular plug-ins designed to maintain long-term persistent access, and it automates evasion by profiling a Linux environment to choose the best nondetection strategy.

Check Point Research described VoidLink as the first case of wholly original malware developed by AI, highlighting its maturity, high functionality and flexible operating model. The project appears to have originated from AI-driven development, with traces pointing to a suspected, unspecified Chinese actor, and development activity was observed from late November 2025, with discovery of previously unseen samples in December.

Building and planning materials surfaced as Chinese-language documents and Markdown files, including guidance copied into the threat actor’s server, and TRAE SOLO, an AI assistant embedded in TRAE IDE, was used to generate the execution plan and initial skeleton. 21 January 2026