Kali Linux 2025.4 has officially been released, delivering a major update that modernizes the desktop experience, strengthens Wayland support, introduces three new security tools, and deepens NetHunter and Wifipumpkin3 integration. Released on December 12, 2025, this version continues Kali’s quarterly release cycle while reinforcing its position as the leading penetration testing and ethical hacking distribution.
This release places strong emphasis on usability improvements, virtualization compatibility, and future-ready infrastructure—without compromising Kali’s extensive offensive security toolkit.
Focus of Kali Linux 2025.4
Kali Linux 2025.4 is designed around three primary goals:
- Desktop modernization with updated environments and consistent theming
- Complete Wayland adoption, including seamless virtual machine support
- Expanded tooling for network, Windows, and AI-assisted penetration testing
With Linux kernel 6.16 and refreshed core packages, Kali 2025.4 delivers both performance and stability improvements across physical and virtual deployments.
Desktop Environment Improvements
GNOME 49: Wayland-Only by Design
GNOME has been upgraded to version 49, marking a significant transition for Kali Linux. GNOME is now entirely Wayland-only, with X11 session support fully removed. This aligns Kali with upstream GNOME development and ensures a cleaner, more secure display stack.
Key improvements include:
- Polished theming across all Kali variants
- A reorganized application grid with tool categories matching the menu structure
- A long-requested terminal shortcut (
Ctrl + Alt + TorWin + T) - Replacement of the legacy Totem video player with Showtime, a modern GTK4-based media player
Showtime introduces chromeless windows, fading controls, and a distraction-free design, reflecting Kali’s shift toward modern GTK4 applications.
KDE Plasma 6.5 Upgrade
Kali Linux 2025.4 upgrades KDE Plasma directly to version 6.5, skipping intermediate versions and delivering two major releases’ worth of enhancements.
Notable KDE improvements include:
- More flexible and intuitive window tiling
- A redesigned screenshot tool with advanced editing options
- Direct panel access to pinned clipboard items
- Improved KRunner search with fuzzy matching, enabling app discovery even with misspellings
KDE continues to ship with Wayland enabled by default, as it has since Kali Linux 2023.1.
Xfce Gains Full Color Theme Support
Xfce users also benefit significantly in this release. For the first time, Xfce offers full color theme customization, achieving feature parity with GNOME and KDE.
Users can now configure:
- GTK 3 and GTK 4 application colors
- Icon themes
- Window manager colors
- Qt application themes via
qt5ctorqt6ct
These changes make Xfce a far more flexible choice for users who prefer lightweight desktops without sacrificing customization.
Full Wayland Support Across Virtual Machines
One of the most important improvements in Kali Linux 2025.4 is complete Wayland support in virtualized environments.
Wayland now works seamlessly in:
- VirtualBox
- VMware
- QEMU
Clipboard sharing, window resizing, and display scaling function correctly across all supported VM platforms. This resolves a long-standing issue that previously forced many penetration testers to remain on X11 for compatibility reasons.
With GNOME now Wayland-only and KDE already optimized for Wayland, this release removes the final technical barriers to full Wayland adoption in Kali Linux.
New Tools Introduced in Kali Linux 2025.4
Kali 2025.4 adds three new tools to its official repositories, each targeting a distinct area of modern security testing.
bpf-linker
bpf-linker is a lightweight static linker designed for Berkeley Packet Filter (BPF) programs. It simplifies the development and deployment of eBPF-based security tools, which are increasingly important for kernel-level observability and monitoring.
evil-winrm-py
evil-winrm-py is a Python-based implementation of the popular Windows Remote Management exploitation framework. It allows security professionals to execute commands on remote Windows systems over the WinRM protocol.
Key features include:
- NTLM authentication
- Pass-the-Hash support
- Certificate-based authentication
- Kerberos authentication
- File upload and download
- Command history and colorized output
This tool is particularly useful for Active Directory assessments and post-exploitation workflows.
hexstrike-ai
hexstrike-ai represents a step toward AI-assisted penetration testing. It functions as an MCP server that enables AI agents to autonomously execute security tools.
This tool highlights Kali’s growing interest in integrating automation and AI into offensive security workflows, especially for reconnaissance, chaining attacks, and tool orchestration.
Linux Kernel 6.16 Upgrade
Kali Linux 2025.4 ships with Linux kernel 6.16, bringing several performance and infrastructure improvements:
- Enhanced compilation optimizations for local CPU architectures
- USB audio offload support
- XFS large atomic write support
- General performance and stability enhancements
Existing installations upgrading to this release will typically land on kernel 6.16.8-1kali1.
Wifipumpkin3 and NetHunter Integration
Although not classified as a brand-new tool, Wifipumpkin3 receives major attention in this release through deeper NetHunter integration.
Wifipumpkin3 is a powerful rogue access point framework that supports:
- Evil Twin attacks
- Captive portal credential harvesting
- DNS spoofing
- Traffic interception
- Custom phishing pages
Built in Python and leveraging GStreamer, it enables full man-in-the-middle wireless attacks using transparent proxies.
The NetHunter app now includes a Wifipumpkin3 preview tab, featuring updated community phishing templates for platforms such as Facebook, Instagram, iCloud, and Snapchat.
Kali NetHunter Mobile Updates
Kali NetHunter sees significant mobile platform expansion in version 2025.4.
Android 16 Support
- Samsung Galaxy S10, S10e, S10 Plus, and S10 5G (LineageOS 23)
- CAN bus support and internal wireless injection enabled
- OnePlus Nord gains Android 16 compatibility
Additional Device Updates
- Xiaomi Mi 9 now supports Android 15
- NetHunter Terminal app fully restored with Magisk compatibility
- Interactive terminal mode prevents accidental session closure
- Magisk installer now supports module installation
Installed kernel modules now appear directly in the NetHunter Modules tab.
Image Distribution and Downloads
Due to size constraints, the Live image now exceeds Cloudflare’s 5GB CDN limit and is available only via BitTorrent. The Live image weighs approximately 4.7GB and includes:
- A fully functional pre-installed Kali system
- Installer support
- Minimal package pool
- XZ compression
The Everything image is also distributed exclusively via BitTorrent.
Weekly builds remain available for users who want the latest packages without waiting for the next quarterly release.
Additional Features and Infrastructure Updates
- Hidden Halloween mode remains accessible via
kali-undercover –halloween - Kali Undercover mode continues to provide Windows-style theming for public use
- New mirror infrastructure added in India, South Korea, and North America, improving global download speeds
Conclusion
Kali Linux 2025.4 is a well-rounded release that successfully balances modernization with stability. The move to full Wayland support, improved VM compatibility, refreshed desktop environments, and the introduction of AI-oriented tooling reflect Kali’s forward-looking approach to penetration testing.
With strong updates to NetHunter, deeper Wifipumpkin3 integration, and kernel-level improvements, Kali Linux 2025.4 is a compelling upgrade for both professional penetration testers and advanced security enthusiasts.
