ChocoShell (CHERRYPIE): PowerShell Infostealer with LLM-Generated Code

ChocoShell, also known as CHERRYPIE, is a PowerShell-based infostealer delivered via ClickFix lures. It steals browser session cookies, saved passwords, Microsoft 365 SSO tokens, and Wi-Fi credentials. Evidence suggests the malware was generated using a large language model (LLM).