Ilya Kabanov

88,000 lines of malware in one week

In January 2026, Check Point Research exposed VoidLink: a Linux malware framework with modular C2, rootkits, cloud enumeration, and 30+ post-exploitation plugins. The initial assessment was that it was the professionally engineered product of a coordinated team working over months.

It was one person. The developer's OPSEC failure later revealed the truth. TRAE, ByteDance's AI IDE, auto-generates helper files that log the guidance given to the model. The developer left these on a server with an open directory. Check Point found them. Without that mistake, no one would have known AI was involved.

The workflow is identical to legitimate software development in 2025: markdown specs, AI agents building sprint by sprint. Cursor, Copilot, Claude Code, and TRAE all work this way. So did the malware developer.

Highlights:

  1. The developer used TRAE SOLO (paid tier) with spec-driven development. Goals, architecture, sprints, coding standards, and acceptance criteria defined in markdown across three virtual teams: Core, Arsenal, Backend.
  2. The AI agent built the framework sprint by sprint. Each sprint produced working, testable code. The developer directed. The AI coded.
  3. The source code matched the specs almost exactly. The codebase was built to those instructions.
  4. 88,000 lines of functional code. First implant around December 4, 2025, one week after development started. Check Point assessed this as a 30-week, three-team equivalent.

My take:

  1. Attribution no longer works. Check Point's own analysts mistook one person's AI-assisted work for a coordinated team effort over months. You can no longer infer who built something from how sophisticated it looks.
  2. Sophisticated attacks are being democratized. VoidLink shows one person with an AI IDE can produce what used to require a team and months. The expertise bar is lowering too: one person with a $200/month Claude subscription found 7 soundness bugs in 72 hours in the Airbus flight control proof checker, work that previously took PhD specialists a year per bug.
  3. Custom malware becomes disposable. It used to be a capital investment reused across campaigns to justify the cost. At one-week turnaround, attackers can build per target, use once, and discard, which breaks signature-based detection that depends on seeing the same tooling twice.
  4. Capable actors are invisible. VoidLink's developer left no trace in forums, and was only exposed because TRAE's auto-generated helper files ended up on an open server. As AI lowers the barrier, less experienced attackers will enter the field, and they will make more OPSEC mistakes, leaving traces useful for detection.
  5. Update your threat model. Custom malware used to require a team and months of work, so only high-value targets justified the investment. At one-week turnaround, your organization may now be worth targeting.

Sources:

  1. VoidLink: Evidence That the Era of Advanced AI-Generated Malware Has Begun (Check Point Research)
  2. AI Threat Landscape Digest January-February 2026 (Check Point Research)
  3. CrowdStrike reported an 89% increase in AI-enabled attacks (The Weather Report)
  4. 7 proofs of False in Rocq, the proof checker that verifies the Airbus C compiler (The Weather Report)