New ChocoPoC malware targets researchers via trojanized PoC exploits

Threat actors are abusing the trust researchers place in public GitHub repositories and the PyPI ecosystem by embedding malicious Python packages into the dependency lists of seemingly legitimate proof-of-concept exploits. When researchers clone these repositories and run standard installation commands, they unknowingly execute the ChocoPoC remote access trojan. This attack is particularly dangerous because it specifically targets security professionals, who are high-value targets with privileged access to sensitive systems and research data. The campaign exploits a systemic blind spot: developers and researchers often install dependencies without scrutinizing the full package supply chain. This highlights how the open-source ecosystem's openness can be weaponized to compromise even technically sophisticated victims.