Secret Undead. A penanggalan may appear in human form. While in human form, magic will reveal only her alignment in real life, not her Lawful Evil alignment. In human form, the penanggalan is not affected by daylight, and cannot be affected by a cleric’s turn or destroy undead abilities. 

Vulnerable to Sunlight. A penanggalan, when struck by sunlight in monstrous form, is Paralyzed until out of the sunlight. 

Acidic Flesh. Any creature that begins or ends its turn within close combat with or Grappled by the penanggalan suffers 3 (1d4 +1) acid damage, and that target cannot regain hit points until the start of the penanggalan’s next turn.

Multiattack. (human or monstrous form) The penanggalan can make two attacks, only one of which can be a Bite.

Weapon Attack. (human form only) Melee Weapon Attack: +6 to hit, reach 5 ft., one creature. Damage is by weapon type.

Bite. (human or monstrous form) Melee Weapon Attack: +6 to hit, reach 5 ft., one creature. Hit: 11 (2d6 + 3) piercing damage plus 7 (2d6) necrotic damage. The target must also make a DC 15 CON saving throw or be Poisoned for 1d6 turns. The target must also make a DC 15 CON saving throw at the end of the day, or be cursed with a wasting disease. Every day, the target must make a DC 15 CON save; on failure, they gain one level of exhaustion. This happens at the end of each consecutive day until the curse is removed, or until the target makes three consecutive CON saves, at which point the target does not gain any further levels of exhaustion. While the target remains under the curse, the levels of exhaustion cannot be removed; the curse can only be removed by a Remove Curse spell or similar means. 

Horrific Transformation. (human form only) The penanggalan transforms from her human form to her monstrous form, by separating her head and entrails from her body. All creatures within 30 feet that can see the transformation must succeed on a DC 20 WIS saving throw or be frightened for 2d4 turns; those who do save are frightened for half that many turns. A creature can only suffer this fear effect once.

Grasping Entrails. (monstrous form only) Melee Weapon Attack: +6 to hit, reach 10 ft., one creature. Hit: 9 (2d6 + 2) bludgeoning damage plus 7 (2d6) acid damage plus 3 (1d6) necrotic damage.

Charm. (human or monstrous form) The penanggalan targets one creature it can see within 30 feet; the target must also be able to see the penanggalan. The target must succeed on a DC 17 WIS saving throw against the creature’s magic or be Charmed by the penanggalan. The Charmed target regards the penanggalan as a trusted friend to be heeded and protected. The target isn’t under the penanggalan’s control, per se,  but it takes the creature’s requests or actions in the most favorable way that it can, and is willing to allow the creature’s Bite attack. (Typically, the monster uses this to make its prey docile for feeding.) Each time the penanggalan does something harmful to the target (including a Bite), the target can repeat the saving throw, ending the effect upon success. Otherwise, the effect lasts for 24 hours, or until the penanggalan is destroyed, on a different plane than the target, or takes a bonus action to end the effect.