A brand new synthetic intelligence (AI)-powered penetration testing instrument linked to a China-based firm has attracted almost 11,000 downloads on the Python Bundle Index (PyPI) repository, elevating issues that it could possibly be repurposed by cybercriminals for malicious functions.
Dubbed Villager, the framework is assessed to be the work of Cyberspike, which has positioned the instruments as a crimson teaming resolution to automate testing workflows. The package deal was first uploaded to PyPI in late July 2025 by a consumer named stupidfish001, a former seize the flag (CTF) participant for the Chinese language HSCSEC staff.
“The speedy, public availability and automation capabilities create a practical danger that Villager will comply with the Cobalt Strike trajectory: commercially or legitimately developed tooling changing into extensively adopted by menace actors for malicious campaigns,” Straiker researchers Dan Regalado and Amanda Rousseau mentioned in a report shared with The Hacker Information.
The emergence of Villager comes shortly after Examine Level revealed that menace actors try to leverage one other nascent AI-assisted offensive safety instrument referred to as HexStrike AI to take advantage of lately disclosed safety flaws.
With the arrival of generative AI (aka GenAI) fashions, menace actors have capitalized on the know-how for social engineering, technical, and data operations in ways in which have possible contributed to elevated velocity, entry to experience, and scalability.
One key benefit to counting on such instruments is that they decrease the barrier to exploitation, and minimize quick the quantity of effort and time required to drag off such assaults. What as soon as required extremely expert operators and weeks of handbook improvement may be automated utilizing AI, providing dangerous actors help with crafting exploits, payload supply, and even infrastructure setup.
“Exploitation may be parallelized at scale, with brokers scanning hundreds of IPs concurrently,” Examine Level famous lately. “Determination-making turns into adaptive; failed exploit makes an attempt may be routinely retried with variations till profitable, rising the general exploitation yield.”
The truth that Villager is offered as an off-the-shelf Python package deal means it provides attackers a straightforward option to combine the instrument into their workflows, Straiker famous, describing it as a “regarding evolution in AI-driven assault tooling.”
Cyberspike first appeared in November 2023, when the area “cyberspike(.)high” was registered below Changchun Anshanyuan Know-how Co., Ltd., an AI firm supposedly based mostly in China. That mentioned, the one supply of details about what the corporate does comes from a Chinese language expertise companies platform referred to as Liepin, elevating questions on who’s behind it.
Snapshots of the area captured on the Web Archive reveal that the instrument is marketed as a community assault simulation and post-penetration take a look at instrument to assist organizations consider and strengthen their cybersecurity posture.
As soon as put in, Cyberspike has been discovered to include plugins which can be parts of a distant entry instrument (RAT), enabling invasive sufferer surveillance and management utilizing distant desktop entry, Discord account compromise, keystroke logging, webcam hijacking, and different monitoring capabilities. Additional evaluation has uncovered similarities with a recognized RAT referred to as AsyncRAT.
“Cyberspike built-in AsyncRAT into its crimson teaming product, with further plugins to well-known hacktools like Mimikatz as effectively,” Straiker mentioned. “These integrations show how Cyberspike repackaged established hacktools and offensive instruments right into a turnkey framework designed for penetration testing and doubtless malicious operations.”
Villager seems to be the newest providing from Cyberspike. Working as a Mannequin Context Protocol (MCP) shopper, it integrates with Kali Linux toolsets, LangChain, and DeepSeek’s AI fashions to automate testing workflows, deal with browser-based interactions, and problem instructions in pure language that may then be transformed into their technical equivalents.
Apart from leveraging a database of 4,201 AI system prompts to generate exploits and make real-time selections in penetration testing, the AI-native penetration testing framework routinely creates remoted Kali Linux containers for community scanning, vulnerability evaluation, and penetration testing, and destroys them after a interval of 24 hours, successfully masking up traces of the exercise.
“The ephemeral nature of those containers, mixed with randomized SSH ports, makes AI-powered assault containers troublesome to detect, complicating forensic evaluation and menace attribution,” the researchers famous.
Command-and-control (C2) is achieved by way of a FastAPI interface that processes incoming duties, whereas the Python-based Pydantic AI agent platform is used to standardize outputs.
“Villager reduces ability and time required to run refined offensive toolchains, enabling less-skilled actors to carry out extra superior intrusions,” the researchers mentioned. “Its task-based structure, the place AI dynamically orchestrates instruments based mostly on aims slightly than following inflexible assault patterns, marks a elementary shift in how cyber assaults are carried out.”
Elevated frequency and velocity of automated reconnaissance, exploitation makes an attempt, and follow-on exercise might increase detection and response burdens throughout the enterprise.”
“Its task-based structure, the place AI dynamically orchestrates instruments based mostly on aims slightly than following inflexible assault patterns, marks a elementary shift in how cyber assaults are carried out.”
