An exploit kit is a type of toolkit used by cybercriminals to exploit security holes in software applications, typically by hosting the kit on malicious websites or by injecting it into compromised, otherwise legitimate websites. When users visit these websites, the exploit kit automatically scans for software vulnerabilities and attempts to exploit them to deliver malicious payloads, such as malware. This makes exploit kits the correct answer for a tool used by threat actors on a webpage to exploit software vulnerabilities and spread malware.