{"id":59997,"date":"2026-01-14T20:39:35","date_gmt":"2026-01-14T20:39:35","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/new-linux-malware-targets-the-cloud-steals-creds-and-then-vanishes\/"},"modified":"2026-01-14T20:39:35","modified_gmt":"2026-01-14T20:39:35","slug":"new-linux-malware-targets-the-cloud-steals-creds-and-then-vanishes","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/new-linux-malware-targets-the-cloud-steals-creds-and-then-vanishes\/","title":{"rendered":"New Linux malware targets the cloud, steals creds, and then vanishes"},"content":{"rendered":"

A brand-new Linux malware named VoidLink targets victims’ cloud infrastructure with more than 30 plugins that allow attackers to perform a range of illicit activities, from silent reconnaissance and credential theft to lateral movement and container abuse. <\/p>\n

When VoidLink detects tampering or malware analysis on an infected machine, it can delete itself and invoke anti-forensics modules designed to remove traces of its activity.<\/p>\n

In December, Check Point Research discovered the previously unseen malware samples written in Zig for Linux and appearing to originate from a Chinese-affiliated development environment with a command-and-control interface localized for Chinese operators.<\/p>\n