Hackers use new HexStrike-AI tool to rapidly exploit n-day flaws

Hackers are increasingly using a new AI-powered offensive security framework called HexStrike-AI in real attacks to exploit newly disclosed n-day flaws, according to CheckPoint Research. The tool, created by cybersecurity researcher Muhammad Osama, is open-source and has been available on GitHub for about a month, attracting 1,800 stars and over 400 forks while being used on hacking forums to automate exploitation of Citrix NetScaler ADC and Gateway zero-days, including CVE-2025-7775.

ShadowServer Foundation data shows nearly 8,000 endpoints remain vulnerable to CVE-2025-7775 as of 2 September 2025, down from 28,000 the previous week. Threat actors reportedly used HexStrike-AI to achieve unauthenticated remote code execution through CVE-2025-7775 and to drop webshells on compromised appliances, with some offering compromised NetScaler instances for sale, though Check Point notes that actual involvement has not been confirmed.

Check Point believes the framework could automate the exploitation chain, scanning for vulnerable instances, crafting exploits, delivering payloads and maintaining persistence, potentially reducing the patching window from days to minutes. The firm stresses that the window between disclosure and exploitation would shrink dramatically, underscoring the need for threat intelligence, AI-driven defenses and adaptive detection.