ChocoPoC RAT Targets Researchers via Fake PoC Exploit Repos on GitHub

Attackers are distributing a data-stealing trojan named ChocoPoC through fake proof-of-concept (PoC) exploit repositories on GitHub, specifically targeting vulnerability researchers. The malware, discovered by YesWeHack and Sekoia, hides in Python dependencies rather than the visible PoC code, allowing it to evade quick code reviews.

The infection chain begins when a researcher clones a fake PoC repo and runs pip install, which pulls in the malicious packages ‘frint’ and ‘skytext’. The skytext package contains a compiled file (gradient.so on Linux, gradient.pyd on Windows) that activates only when the real PoC script is loaded, checking for a file named EXPLOIT_POC.py. This conditional execution helps it evade sandbox detection.

Once running, ChocoPoC functions as a full remote access trojan (RAT), stealing saved passwords, cookies, autofill data, and browsing history from Chrome, Brave, Edge, and Firefox. It also exfiltrates text files, notes, local databases, shell history, network settings, and running processes. The attacker can execute shell commands, run arbitrary Python code, and pull entire folders. Command names in Spanish and minor code bugs suggest the malware is hand-written rather than AI-generated.

For command and control, ChocoPoC uses Mapbox as a dead drop, reading orders from a dataset on the legitimate mapping service. It resolves addresses via DNS-over-HTTPS and uses domain-fronting to make traffic appear as normal Mapbox API calls. Larger uploads go to a separate server at 91.132.163.78.

Researchers identified at least seven fake PoC repos, each tied to high-profile CVEs: CVE-2025-64446 (FortiWeb), CVE-2025-55182 (React2Shell), CVE-2025-14847 (MongoBleed), CVE-2026-0257 (PAN-OS), CVE-2026-10520 (Ivanti Sentry), CVE-2026-50751 (Check Point VPN), and CVE-2026-48908 (Joomla SP Page Builder). The skytext package was downloaded approximately 2,400 times, with spikes following major CVE disclosures. An earlier campaign used packages ‘slogsec’ and ‘logcrypt.cryptography’ with similar code, attributed to the same actor.

Security researchers are prime targets due to their high-privilege access and tendency to run untrusted code. The campaign echoes previous attacks like MUT-1244 and Lazarus Group operations. ChocoPoC’s key innovation is hiding malware in dependencies, making the visible PoC appear clean. Researchers advise treating all PoCs as hostile, checking for the malicious packages, and rotating credentials if compromised.