Kali Linux 2025.3 Released with Ten New Tools

The developers of Kali Linux have announced version 2025.3, the third release of the year. The update introduces ten new tools, Nexmon support, and multiple NetHunter enhancements.
Nexmon Support Returns
Nexmon is a framework for patching the firmware of Broadcom and Cypress Wi-Fi chips, enabling monitor mode and frame injection. Its return is notable for Raspberry Pi users, who were promised expanded Wi-Fi capabilities earlier this year.
“In Kali 2025.1, we changed how the Raspberry Pi kernel is packaged and also moved to a new major version,” the developers wrote. “Now, Nexmon support is back, including for the Raspberry Pi 5. Other devices besides the Raspberry Pi can also use Nexmon.”
NetHunter Updates
This release also brings updates to Kali NetHunter, including support for the Samsung S10, and improvements to NetHunter Car Hacking, which features an updated UI and bug fixes. The Kali team also announced plans to release a demonstration video for CARsenal, showcasing its various capabilities.

Ten New Tools
Kali Linux 2025.3 ships with the following new tools:
- Caido — client component of the Caido web security auditing toolkit (graphical/desktop interface).
- Caido-cli — server component of Caido.
- Detect It Easy (DiE) — file type identifier.
- Gemini CLI — open-source AI agent that integrates Gemini capabilities into the terminal.
- krbrelayx — toolkit for Kerberos relay attacks and abusing unconstrained delegation.
- ligolo-mp — multi-platform pivoting solution.
- llm-tools-nmap — enables an LLM to conduct network reconnaissance and vulnerability scanning via nmap.
- mcp-kali-server — Model Context Protocol configuration for connecting an AI agent to Kali.
- patchleaks — analyzes patches and provides detailed vulnerability descriptions for quick verification or exploitation.
- vwifi-dkms — creates dummy Wi-Fi networks, manages connections, and handles disconnections.
Additional Changes
Other notable changes in Kali Linux 2025.3 include:
- The VPN IP panel plugin in Xfce now allows selecting a monitored interface, making it easier to copy the VPN connection’s IP address to the clipboard.
- Discontinuation of ARMel support (Acorn RISC Machine, Little-Endian).
- Ability to install kernel modules with Magisk, currently available as an experimental feature.
