A brand new synthetic intelligence (AI)-powered penetration testing software linked to a China-based firm has attracted almost 11,000 downloads on the Python Package deal Index (PyPI) repository, elevating considerations that it could possibly be repurposed by cybercriminals for malicious functions.
Dubbed Villager, the framework is assessed to be the work of Cyberspike, which has positioned the instruments as a pink teaming answer to automate testing workflows. The package deal was first uploaded to PyPI in late July 2025 by a consumer named stupidfish001, a former seize the flag (CTF) participant for the Chinese language HSCSEC workforce.
“The fast, public availability and automation capabilities create a sensible threat that Villager will comply with the Cobalt Strike trajectory: commercially or legitimately developed tooling changing into extensively adopted by menace actors for malicious campaigns,” Straiker researchers Dan Regalado and Amanda Rousseau mentioned in a report shared with The Hacker Information.
The emergence of Villager comes shortly after Verify Level revealed that menace actors try to leverage one other nascent AI-assisted offensive safety software known as HexStrike AI to use lately disclosed safety flaws.
With the arrival of generative AI (aka GenAI) fashions, menace actors have capitalized on the expertise for social engineering, technical, and data operations in ways in which have doubtless contributed to elevated velocity, entry to experience, and scalability.
One key benefit to counting on such instruments is that they decrease the barrier to exploitation, and lower brief the quantity of effort and time required to drag off such assaults. What as soon as required extremely expert operators and weeks of guide improvement might be automated utilizing AI, providing dangerous actors help with crafting exploits, payload supply, and even infrastructure setup.
“Exploitation might be parallelized at scale, with brokers scanning hundreds of IPs concurrently,” Verify Level famous lately. “Choice-making turns into adaptive; failed exploit makes an attempt might be robotically retried with variations till profitable, rising the general exploitation yield.”
The truth that Villager is offered as an off-the-shelf Python package deal means it provides attackers a simple approach to combine the software into their workflows, Straiker famous, describing it as a “regarding evolution in AI-driven assault tooling.”
Cyberspike first appeared in November 2023, when the area “cyberspike[.]prime” was registered below Changchun Anshanyuan Know-how Co., Ltd., an AI firm supposedly primarily based in China. That mentioned, the one supply of details about what the corporate does comes from a Chinese language expertise providers platform known as Liepin, elevating questions on who’s behind it.
Snapshots of the area captured on the Web Archive reveal that the software is marketed as a community assault simulation and post-penetration take a look at software to assist organizations consider and strengthen their cybersecurity posture.
As soon as put in, Cyberspike has been discovered to include plugins which might be parts of a distant entry software (RAT), enabling invasive sufferer surveillance and management utilizing distant desktop entry, Discord account compromise, keystroke logging, webcam hijacking, and different monitoring features. Additional evaluation has uncovered similarities with a recognized RAT known as AsyncRAT.
“Cyberspike built-in AsyncRAT into its pink teaming product, with further plugins to well-known hacktools like Mimikatz as properly,” Straiker mentioned. “These integrations exhibit how Cyberspike repackaged established hacktools and offensive instruments right into a turnkey framework designed for penetration testing and doubtless malicious operations.”
Villager seems to be the newest providing from Cyberspike. Working as a Mannequin Context Protocol (MCP) shopper, it integrates with Kali Linux toolsets, LangChain, and DeepSeek’s AI fashions to automate testing workflows, deal with browser-based interactions, and situation instructions in pure language that may then be transformed into their technical equivalents.
Moreover leveraging a database of 4,201 AI system prompts to generate exploits and make real-time choices in penetration testing, the AI-native penetration testing framework robotically creates remoted Kali Linux containers for community scanning, vulnerability evaluation, and penetration testing, and destroys them after a interval of 24 hours, successfully overlaying up traces of the exercise.
“The ephemeral nature of those containers, mixed with randomized SSH ports, makes AI-powered assault containers troublesome to detect, complicating forensic evaluation and menace attribution,” the researchers famous.
Command-and-control (C2) is completed by way of a FastAPI interface that processes incoming duties, whereas the Python-based Pydantic AI agent platform is used to standardize outputs.
“Villager reduces ability and time required to run subtle offensive toolchains, enabling less-skilled actors to carry out extra superior intrusions,” the researchers mentioned. “Its task-based structure, the place AI dynamically orchestrates instruments primarily based on aims somewhat than following inflexible assault patterns, marks a basic shift in how cyber assaults are carried out.”
Elevated frequency and velocity of automated reconnaissance, exploitation makes an attempt, and follow-on exercise may elevate detection and response burdens throughout the enterprise.”
“Its task-based structure, the place AI dynamically orchestrates instruments primarily based on aims somewhat than following inflexible assault patterns, marks a basic shift in how cyber assaults are carried out.”
