Ledger / Nov 2025
VoidLink: advanced Linux cloud malware framework built almost entirely by AI
Confirmed
Check Point recovered AI-generated planning and helper files left by the developer's own OPSEC failure; Elastic independently corroborated.
Leaked TRAE-generated helper files showed one developer used spec-driven development with an AI assistant to produce a Zig-based C2 framework. Check Point called it the first well-documented advanced malware written mostly by AI.
“VoidLink’s development likely began in late November 2025, when its developer turned to TRAE SOLO, an AI assistant embedded in TRAE , an AI-centric IDE.”Check Point Research
Sources
- VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has BegunCheck Point Research · 20 Jan 2026 · primary source
- An AI wrote VoidLink, the cloud-targeting Linux malwareThe Register · 20 Jan 2026 · secondary source
- Date
- Nov 2025
- Disclosed
- 20 Jan 2026
- Actor
- Unnamed single developer (unknown), as attributed by Check Point Research
- Nexus
- China
- Targets
- Cloud workloads on AWS, GCP, Azure, Alibaba, Tencent; Docker/Kubernetes
- What the AI did
- Malware dev, Evasion
- Model
- TRAE SOLO (AI assistant in the TRAE IDE)
- Model family
- Unspecified
- Model basis
- stated by researcher
- Autonomy
- assist
- Outcome
- Framework with implants, rootkit evasion and dozens of plugins; first functional implant reportedly within a week; in-progress, not confirmed deployed at scale.