Experts warn this new Chinese Linux malware could be preparing something seriously worrying

• Check Point Research discovers an advanced Linux malware framework with 30+ plugins
• VoidLink targets cloud environments, harvesting credentials and adapting to AWS, Azure, GCP, and more
• No active abuse yet; suspected Chinese state-linked development for espionage and persistent access

Check Point Research (CPR) has uncovered a previously unknown and unusually advanced Linux malware framework called VoidLink.

In an in-depth report, CPR says VoidLink is cause for concern since it is a full command-and-control (C2) platform with loaders, implants, rootkits, and more than 30 modular plugins.

All these features are designed to give attackers stealthy, persistent, and long-term control over compromised systems, and were being developed as recently as late 2025.

Hackers ...