VoidLink Linux Malware Framework Built with AI Assistance Reaches 88,000 Lines of Code

According to Check Point Research, the VoidLink Linux malware framework was likely created by a single developer with AI assistance and reached more than 88,000 lines of code by early December 2025. Described as a feature‑rich framework written in Zig, VoidLink is aimed at long‑term, stealthy access to Linux‑based cloud environments and is believed to originate from a Chinese‑affiliated development environment.

The researchers note signs suggesting the development relied on an AI model, with a follow‑up analysis highlighting an AI‑generated workflow that accelerated planning, building, and testing the tool. The project is said to have used TRAE SOLO to carry out tasks, and TRAE‑generated helper files were found on the threat actor’s server, later leaked in an exposed open directory.

Check Point also cites internal planning material in Chinese—sprint schedules, feature breakdowns, and coding guidelines—strongly indicative of large language model content, with a documented plan created on 27 November 2025. As a result, the authors described VoidLink as illustrating how AI can speed the development of sophisticated malware, removing the need for large teams in some cases.