ChocoPoC Malware Targets Security Researchers via Trojanized PoC Exploits on GitHub

The ChocoPoC campaign delivers a Python remote access trojan through weaponized proof-of-concept repositories on GitHub by hiding malicious behavior in transitive Python package dependencies rather than in the exploit script itself. The attacker adds "frint" and "skytext" to the repository requirements; during installation, "skytext" loads a compiled native extension (gradient.so on Linux or gradient.pyd on Windows) that executes when the PoC runs, decrypts embedded Python scripts, and drops a persistent loader (_distutils_hack) plus malicious .pth hooks that respawn a hidden interpreter. The downloader (choco.py) then fetches the final stage from a Mapbox dataset dead-drop (feature ID dm370543acmdopk296nahbtua via api.mapbox.com), using DoH resolution through alidns.com and cloudflare-dns.com, domain-fronting TLS with a forced Host header, and Base64 decoding of a hardcoded properties field before exec(). The RAT executes arbitrary shell and Python commands (prefixed hola, cmd, python, get, browserdata, dormir), harvests browser credentials and cookies from Chrome, Brave, Edge, and Firefox, collects .txt, .md, and database files, reads .bash_history and .zsh_history, gathers network configuration and running process lists, and exfiltrates via both Mapbox and an external HTTP endpoint at 91.132.163.78:8001/assets/static/bundle.ext.min.de5b2bc9.js. Sekoia identified seven malicious repositories hosting exploits for FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908), with "skytext" downloaded 2,400 times, predominantly on Linux.

What makes this story matter is not the malware's capabilities but the victim profile and the supply-chain deception: vulnerability researchers and penetration testers are the targets, and they are specifically selected because they routinely run untrusted code with elevated privileges, handle customer credentials, and maintain isolated labs that are still valuable to an attacker. The attacker kept the visible PoC almost entirely benign, delegating malicious behavior to packages that appear harmless in isolation, which means automated sandboxes and manual reviews focused only on the exploit script will miss the infection entirely. The 2,400 downloads of "skytext" indicate a broad exposure surface among the security community, and the reuse of compromised GitHub and PyPI accounts makes malicious repositories look credible rather than new or suspicious. Because a single compromised researcher laptop can expose VPN configurations, confidential reports, and internal documentation far beyond the individual workstation, this is a targeted supply-chain attack against the very people tasked with finding and fixing vulnerabilities, not a generic spyware drop.

Defenders should treat every PoC repository as untrusted and inspect the full dependency chain for recently published or obscure packages such as "frint" (v0.1.2, SHA-256 17997e9e0256d0f5d5d21a4852c37f16b338e4bb9c2bec09bdfd822b24aa76b4) and "skytext" (v1.1.0, SHA-256 93739477cd379adef95126b22758c0e644282d2028dd297328ce856fa111dd06) rather than reviewing only the exploit script. When testing PoCs, execute only inside disposable virtual machines with no access to production credentials, shared drives, or the researcher's primary browser profile, and check the Python site-packages directory for unexpected .pth files, trojanised _distutils_hack packages, or compiled extensions like gradient.so or gradient.pyd. Hunt for environment variables ZEBUWIAKGPHOQAP006=PTsjBGKQUxZorq2 and JKHWQVEKRASDF12=JKHKJ23VAS8DF9, monitor for outbound HTTPS connections to api.mapbox.com with custom Host headers or IP-based requests, and look for hidden Python processes launching choco.py or importing choco. For network telemetry, flag traffic to the chunked upload endpoint at 91.132.163.78:8001/assets/static/bundle.ext.min.de5b2bc9.js and DNS-over-HTTPS queries to alidns.com or cloudflare-dns.com resolving api.mapbox.com.

The assessment changes if the attacker updates the Mapbox dataset feature or rotates the dead-drop token (currently [REDACTED]), if new malicious repositories appear targeting additional CVEs beyond the seven already identified (CVE-2025-64446 through CVE-2026-48908), or if telemetry confirms active exploitation of the 2,400 downloaded installations through observed C2 check-ins or data exfiltration to 91.132.163.78. A shift from dependency-based delivery back to embedded malware in the PoC script would also alter detection priorities.