VoidLink Malware Framework Attacking Kubernetes and AI Workloads

VoidLink is a sophisticated, cloud-native Linux malware framework disclosed by Check Point Research and observed in active campaigns by Cisco Talos; it targets containers and cloud workloads on major cloud platforms, uses fileless execution and kernel-evasive techniques, and can harvest cloud metadata, API credentials, and other secrets while adapting its behavior based on the environment. Its compile-on-demand capability and stealthy persistence make it a high-risk threat to Kubernetes and containerized AI/cloud workloads, prompting recommendations for kernel-level monitoring (eBPF), credential rotation, and tightened pod permissions.