A brand new synthetic intelligence (AI)-powered penetration testing software linked to a China-based firm has attracted almost 11,000 downloads on the Python Bundle Index (PyPI) repository, elevating issues that it might be repurposed by cybercriminals for malicious functions.
Dubbed Villager, the framework is assessed to be the work of Cyberspike, which has positioned the instruments as a crimson teaming resolution to automate testing workflows. The bundle was first uploaded to PyPI in late July 2025 by a consumer named stupidfish001, a former seize the flag (CTF) participant for the Chinese language HSCSEC crew.
“The fast, public availability and automation capabilities create a practical danger that Villager will comply with the Cobalt Strike trajectory: commercially or legitimately developed tooling changing into extensively adopted by menace actors for malicious campaigns,” Straiker researchers Dan Regalado and Amanda Rousseau stated in a report shared with The Hacker Information.
The emergence of Villager comes shortly after Test Level revealed that menace actors are trying to leverage one other nascent AI-assisted offensive safety software referred to as HexStrike AI to take advantage of lately disclosed safety flaws.
With the appearance of generative AI (aka GenAI) fashions, menace actors have capitalized on the expertise for social engineering, technical, and knowledge operations in ways in which have probably contributed to elevated velocity, entry to experience, and scalability.
One key benefit to counting on such instruments is that they decrease the barrier to exploitation, and lower quick the quantity of effort and time required to tug off such assaults. What as soon as required extremely expert operators and weeks of guide improvement will be automated utilizing AI, providing unhealthy actors help with crafting exploits, payload supply, and even infrastructure setup.
“Exploitation will be parallelized at scale, with brokers scanning hundreds of IPs concurrently,” Test Level famous lately. “Determination-making turns into adaptive; failed exploit makes an attempt will be mechanically retried with variations till profitable, growing the general exploitation yield.”
The truth that Villager is out there as an off-the-shelf Python bundle means it presents attackers a simple solution to combine the software into their workflows, Straiker famous, describing it as a “regarding evolution in AI-driven assault tooling.”
Cyberspike first appeared in November 2023, when the area “cyberspike[.]prime” was registered below Changchun Anshanyuan Know-how Co., Ltd., an AI firm supposedly based mostly in China. That stated, the one supply of details about what the corporate does comes from a Chinese language expertise providers platform referred to as Liepin, elevating questions on who’s behind it.
Snapshots of the area captured on the Web Archive reveal that the software is marketed as a community assault simulation and post-penetration take a look at software to assist organizations consider and strengthen their cybersecurity posture.
As soon as put in, Cyberspike has been discovered to include plugins which might be elements of a distant entry software (RAT), enabling invasive sufferer surveillance and management utilizing distant desktop entry, Discord account compromise, keystroke logging, webcam hijacking, and different monitoring capabilities. Additional evaluation has uncovered similarities with a recognized RAT referred to as AsyncRAT.
“Cyberspike built-in AsyncRAT into its crimson teaming product, with extra plugins to well-known hacktools like Mimikatz as effectively,” Straiker stated. “These integrations exhibit how Cyberspike repackaged established hacktools and offensive instruments right into a turnkey framework designed for penetration testing and possibly malicious operations.”
Villager seems to be the newest providing from Cyberspike. Working as a Mannequin Context Protocol (MCP) shopper, it integrates with Kali Linux toolsets, LangChain, and DeepSeek’s AI fashions to automate testing workflows, deal with browser-based interactions, and situation instructions in pure language that may then be transformed into their technical equivalents.
Moreover leveraging a database of 4,201 AI system prompts to generate exploits and make real-time selections in penetration testing, the AI-native penetration testing framework mechanically creates remoted Kali Linux containers for community scanning, vulnerability evaluation, and penetration testing, and destroys them after a interval of 24 hours, successfully masking up traces of the exercise.
“The ephemeral nature of those containers, mixed with randomized SSH ports, makes AI-powered assault containers troublesome to detect, complicating forensic evaluation and menace attribution,” the researchers famous.
Command-and-control (C2) is completed by way of a FastAPI interface that processes incoming duties, whereas the Python-based Pydantic AI agent platform is used to standardize outputs.
“Villager reduces ability and time required to run refined offensive toolchains, enabling less-skilled actors to carry out extra superior intrusions,” the researchers stated. “Its task-based structure, the place AI dynamically orchestrates instruments based mostly on targets moderately than following inflexible assault patterns, marks a elementary shift in how cyber assaults are carried out.”
Elevated frequency and velocity of automated reconnaissance, exploitation makes an attempt, and follow-on exercise might elevate detection and response burdens throughout the enterprise.”
“Its task-based structure, the place AI dynamically orchestrates instruments based mostly on targets moderately than following inflexible assault patterns, marks a elementary shift in how cyber assaults are carried out.”
