VoidLink: The “Cloud-First” Malware Hunting Your Linux Servers

VoidLink is a commercial-grade, cloud-first malware framework discovered in December 2025 that targets Linux servers, Docker containers, and Kubernetes clusters. Written primarily in Zig with a modular Plugin API and a web dashboard, it ships with 30+ plugins for credential harvesting, anti-forensics, and more; employs adaptive stealth to detect EDR and deploy userland or eBPF-based rootkits; and is localized for Chinese speakers, suggesting China-affiliated developers and posing a significant supply-chain and cloud-infrastructure risk.