A brand new synthetic intelligence (AI)-powered penetration testing software linked to a China-based firm has attracted almost 11,000 downloads on the Python Package deal Index (PyPI) repository, elevating considerations that it may very well be repurposed by cybercriminals for malicious functions.
Dubbed Villager, the framework is assessed to be the work of Cyberspike, which has positioned the instruments as a pink teaming resolution to automate testing workflows. The package deal was first uploaded to PyPI in late July 2025 by a consumer named stupidfish001, a former seize the flag (CTF) participant for the Chinese language HSCSEC crew.
“The fast, public availability and automation capabilities create a practical danger that Villager will comply with the Cobalt Strike trajectory: commercially or legitimately developed tooling turning into extensively adopted by risk actors for malicious campaigns,” Straiker researchers Dan Regalado and Amanda Rousseau mentioned in a report shared with The Hacker Information.
The emergence of Villager comes shortly after Examine Level revealed that risk actors try to leverage one other nascent AI-assisted offensive safety software referred to as HexStrike AI to use lately disclosed safety flaws.
With the arrival of generative AI (aka GenAI) fashions, risk actors have capitalized on the know-how for social engineering, technical, and knowledge operations in ways in which have possible contributed to elevated velocity, entry to experience, and scalability.
One key benefit to counting on such instruments is that they decrease the barrier to exploitation, and reduce brief the quantity of effort and time required to drag off such assaults. What as soon as required extremely expert operators and weeks of guide growth will be automated utilizing AI, providing dangerous actors help with crafting exploits, payload supply, and even infrastructure setup.
“Exploitation will be parallelized at scale, with brokers scanning hundreds of IPs concurrently,” Examine Level famous lately. “Choice-making turns into adaptive; failed exploit makes an attempt will be mechanically retried with variations till profitable, rising the general exploitation yield.”
The truth that Villager is on the market as an off-the-shelf Python package deal means it affords attackers a straightforward solution to combine the software into their workflows, Straiker famous, describing it as a “regarding evolution in AI-driven assault tooling.”
Cyberspike first appeared in November 2023, when the area “cyberspike[.]prime” was registered beneath Changchun Anshanyuan Know-how Co., Ltd., an AI firm supposedly primarily based in China. That mentioned, the one supply of details about what the corporate does comes from a Chinese language expertise providers platform referred to as Liepin, elevating questions on who’s behind it.
Snapshots of the area captured on the Web Archive reveal that the software is marketed as a community assault simulation and post-penetration check software to assist organizations consider and strengthen their cybersecurity posture.
As soon as put in, Cyberspike has been discovered to include plugins which are parts of a distant entry software (RAT), enabling invasive sufferer surveillance and management utilizing distant desktop entry, Discord account compromise, keystroke logging, webcam hijacking, and different monitoring capabilities. Additional evaluation has uncovered similarities with a identified RAT referred to as AsyncRAT.
“Cyberspike built-in AsyncRAT into its pink teaming product, with extra plugins to well-known hacktools like Mimikatz as properly,” Straiker mentioned. “These integrations show how Cyberspike repackaged established hacktools and offensive instruments right into a turnkey framework designed for penetration testing and doubtless malicious operations.”
Villager seems to be the most recent providing from Cyberspike. Working as a Mannequin Context Protocol (MCP) shopper, it integrates with Kali Linux toolsets, LangChain, and DeepSeek’s AI fashions to automate testing workflows, deal with browser-based interactions, and subject instructions in pure language that may then be transformed into their technical equivalents.
Moreover leveraging a database of 4,201 AI system prompts to generate exploits and make real-time selections in penetration testing, the AI-native penetration testing framework mechanically creates remoted Kali Linux containers for community scanning, vulnerability evaluation, and penetration testing, and destroys them after a interval of 24 hours, successfully overlaying up traces of the exercise.
“The ephemeral nature of those containers, mixed with randomized SSH ports, makes AI-powered assault containers tough to detect, complicating forensic evaluation and risk attribution,” the researchers famous.
Command-and-control (C2) is achieved by way of a FastAPI interface that processes incoming duties, whereas the Python-based Pydantic AI agent platform is used to standardize outputs.
“Villager reduces talent and time required to run refined offensive toolchains, enabling less-skilled actors to carry out extra superior intrusions,” the researchers mentioned. “Its task-based structure, the place AI dynamically orchestrates instruments primarily based on targets somewhat than following inflexible assault patterns, marks a basic shift in how cyber assaults are carried out.”
Elevated frequency and velocity of automated reconnaissance, exploitation makes an attempt, and follow-on exercise may elevate detection and response burdens throughout the enterprise.”
“Its task-based structure, the place AI dynamically orchestrates instruments primarily based on targets somewhat than following inflexible assault patterns, marks a basic shift in how cyber assaults are carried out.”
