Multiple weaponized proof-of-concept (PoC) exploits on GitHub delivered a Python-based remote access trojan (RAT) called ChocoPoC that can execute commands and steal sensitive data.

Erfahren Sie, wie ChocoPoC in GitHub-Repositories verteilt wird und Sicherheitsforscher möglicherweise gefährdet.

ChocoPoC operates by hiding its malicious payload within a Python package that is pulled in as a dependency by the seemingly harmless PoC code.

Attackers are hiding the ChocoPoC data-stealing trojan inside fake Python exploit repositories that target security researchers rushing to test new CVEs. The malware steals browser credentials and files, then uses dependency chains, Mapbox, and other infrastructure to stay hidden while spreading through malicious PoCs. #ChocoPoC #YesWeHack #Sekoia #Mapbox #GitHub #PyPI...

Multiple weaponized proof-of-concept (PoC) exploits on GitHub were found delivering a Python-based remote access trojan (RAT) named ChocoPoC that can execute commands and steal sensitive data in a campaign believed to target cybersecurity researchers. [...]

Fake CVE exploit repos pull frint and skytext packages to steal researcher credentials, with servers still live as of July 1.

A new malware campaign, ChocoPoC, is targeting security researchers by distributing a Python RAT through trojanized proof-of-concept exploits hosted on GitHub.

ChocoPoC hides a credential-stealing trojan inside fake CVE proof-of-concept repos, targeting the researchers and red teams who download and test them.

YesWeHack and Sekoia TDR uncovered ChocoPoC, a Python RAT hidden in fake CVE PoC repositories and malicious PyPI dependencies used to target vulnerability researchers and pentesters. The campaign abused GitHub, PyPI, and Mapbox infrastructure to deliver payloads, persist in Python environments, and steal data, with at least 7 lure repositories identified and the malware still active. #ChocoPoC #YesWeHack #SekoiaTDR #Mapbox #frint #skytext

Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs. Run one, and it quietly lifts your saved passwords, browser cookies, and files, then hands the attacker a shell on your machine. YesWeHack and

GitHub上に存在する複数の武器化された概念実証(PoC)エクスプロイトが、コマンド実行や機密データの窃取が可能なPythonベースのリモートアクセス型トロイの木馬(RAT)「ChocoPoC」を配布していたことが分かりました。 各種脆弱性向けのPoCエクスプロイトにマルウェアを隠す手口自体は目新しいものではありま

This article details a campaign targeting vulnerability researchers with "ChocoPoC" malware embedded inside trojanised Python dependencies. Exploiting the pressure to quickly test new vulnerabilities,...

Introduction: In late June 2026, YesWeHack’s vulnerability intelligence team published an analysis of a critical unauthenticated RCE flaw in the Joomla JCE extension (CVE-2026-48907), including a proof-of-concept (PoC) and a Nuclei template. Within days, an attacker leveraged that very research to launch a sophisticated social‑engineering campaign. Posing as a contributor, they submitted two supposed PoCs for a related Joomla vulnerability—one of which contained a previously undocumented, fully functional Python RAT dubbed “ChocoPoC”.

Read more