ChocoPoC is a remote access trojan that hides in Python dependencies of fake PoC exploit repositories on GitHub. It steals credentials, cookies, and files from researchers, using Mapbox for C2 communication. The malware was discovered by YesWeHack and Sekoia in July 2026.