New AI Penetration Tool Villager Gains Popularity, Downloaded 10,000 Times in Two Months

A new penetration testing tool called Villager, described as the AI successor to Cobalt Strike, has gained significant traction, being downloaded approximately 10,000 times since its launch in July 2025. The tool, published on the Python Package Index, integrates various security tools, including Kali Linux, and is powered by AI models that automate testing workflows. Although it can be used for legitimate penetration testing, it is equally poised for malicious use due to its fully automated nature, requiring little expertise to deploy effectively. Villager includes AI-driven exploits and systems to bypass detection, making it highly appealing to cyber attackers. Linked to a suspicious China-based company called Cyberspike, the tool has raised concerns among cybersecurity researchers, particularly because it also integrates with known hacking tools like AsyncRAT and Mimikatz. Despite its questionable origin, it has gained attention from security experts who are urging defenders to adopt AI-based defensive strategies to counter this rapidly evolving threat. With AI increasingly being leveraged for both offense and defense, the rapid development and distribution of tools like Villager signal a shift in the cybersecurity landscape, demanding quicker and more sophisticated responses from defenders.