Chinese AI Pentesting Tool Villager Achieves 10,000+ Downloads
Cyberspike, a Chinese company with ties to hacker circles, released Villager, an AI-powered pentesting tool combining Kali Linux and DeepSeek AI, in July 2025. The tool automates cyberattacks and has accumulated over 10,000 downloads in two months, raising concerns about potential use by threat actors to conduct automated attacks at scale.
What happened
A Chinese company called Cyberspike released Villager, an AI-native penetration testing tool, in July 2025 on the Python Package Index.
Villager automates cyberattacks by combining Kali Linux tools with DeepSeek AI models to fully automate attack workflows.
The tool has accumulated over 10,000 downloads within its first two months of availability.
Reported impact
Security researchers have raised concerns that threat actors, including those in malware and hacker circles, may have downloaded the tool.
The tool raises dual-use concerns, as it can be used by both security professionals and malicious actors to conduct automated cyberattacks at scale.
Index analysis
Villager represents an example of AI-powered Persistent Threat Actors (AIPT) that can automate and scale cyberattacks without human intervention.
The rapid adoption of the tool suggests potential interest from threat actors seeking to leverage AI for automated attack capabilities.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.