"Villager, a new penetration-testing tool linked to a suspicious China-based company and described by researchers as "Cobalt Strike's AI successor," has been downloaded about 10,000 times since its release in July. The package, published on Python Package Index, operates as a Model Context Protocol (MCP) client and integrates multiple security tools. It includes Kali Linux, which legitimate defenders use to automate penetration testing, and it contains hundreds of tools that can also be used to launch cyber attacks at scale."
"Villager also contains DeepSeek AI models to automate testing workflows, plus a ton of other AI tools like a database of 4,201 AI system prompts to generate exploits and other mechanisms to make it difficult to detect. "Like Cobalt Strike, it can be used for legitimate purposes but it is also ready to be used maliciously without expertise needed since it is fully automated," Dan Regalado, principal AI security researcher at Straiker, told The Register. "And we see downloads every day, not massively but consistently.""
Villager is an AI-powered penetration-testing package published on the Python Package Index that functions as a Model Context Protocol (MCP) client and integrates multiple security tools. The package bundles Kali Linux and hundreds of tools that can automate penetration testing or be repurposed to launch cyber attacks at scale. Villager includes DeepSeek AI models, numerous AI utilities, and a database of 4,201 AI system prompts to generate exploits and evade detection. Villager has been downloaded about 9,952 times across Linux, macOS, and Windows, averaging roughly 200 downloads every three days. The package was traced to a China-linked organization registered under Changchun Anshanyuan Technology Co.
Read at Theregister
Unable to calculate read time
Collection
[
|
...
]