VoidLink Malware Exhibits Multi-Cloud Capabilities and AI Code

VoidLink is a Linux C2 implant designed for long-term intrusions across cloud and enterprise environments: it fingerprints AWS/GCP/Azure/Alibaba/Tencent, harvests credentials (env vars, SSH keys, shell history, Kubernetes secrets), supports container escape and Kubernetes privilege escalation, and employs kernel-level stealth (eBPF/LKM/userland hooking). The modular agent uses AES-256-GCM over HTTPS for C2 and contains unusual development artefacts (duplicated phase labels, verbose logs) that suggest AI-assisted coding; researchers report it as an operational implant with live infrastructure.