Virtual Machines in Minutes and Wi-Fi on Steroids: What's New in the Latest Kali Linux Release
This update holds far more than what meets the eye.
The developers of Kali Linux have introduced a new release—2025.3—which expands the distribution's capabilities and adds ten fresh tools for penetration testing. The update improves deployment processes in virtual environments, restores support for wireless drivers on Raspberry Pi, revamps several plugins, and ends support for the legacy ARMel architecture.
The developers have completely rebuilt the virtual image creation process, updating integration with HashiCorp Packer and Vagrant. The scripts now use the Version 2 standard, ensuring consistency when building templates. For automated installation, the pre-configuration files have been standardized, and Vagrant scripts have been taught to apply additional settings immediately after launch, saving users from routine tasks when deploying labs.
A significant addition is the return of Nexmon for Broadcom and Cypress chips, including the Raspberry Pi 5. This patch enables monitor mode and packet injection on devices where it's unavailable with standard drivers. At the same time, support for the ARMel architecture has been discontinued, following Debian's decision to end support after the "trixie" release. The freed-up resources are being directed toward preparing for future RISC-V support.
For Xfce users, there is a refined VPN IP panel that allows selecting an interface for tracking and quickly copying the address of the specific connection needed.
The repository has gained ten new tools. Among them are graphical and console interfaces for Caido for web security auditing, the Detect It Easy utility for file type recognition, Gemini CLI with an AI agent integrated directly into the terminal, and krbrelayx for Kerberos attacks. Also added are ligolo-mp for traffic proxying, llm-tools-nmap for network scanning using language models, patchleaks for patch analysis, and vwifi-dkms for creating fake Wi-Fi networks.
The mobile direction, Kali NetHunter, received important updates. Support for compatible devices now includes internal monitoring with frame injection in the 2.4 and 5 GHz bands. Porting to the Samsung Galaxy S10 resulted in a Broadcom firmware, a specialized kernel, and a stable ARM64 version of the Hijacker utility.
The automotive module, CARsenal, underwent package updates and added new features, which require re-running the installation script to activate.
Thus, Kali Linux 2025.3 combines a revamped virtualization infrastructure, updated drivers for wireless adapters, and a set of new utilities, making the distribution even more convenient and relevant for security testing specialists.
