New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
ChocoPoC RAT targets vulnerability researchers via fake Python exploit PoC repositories on GitHub.
Attackers are distributing a remote access trojan named ChocoPoC hidden within fake Python proof-of-concept (PoC) exploit repositories on GitHub. The malware is designed to steal credentials, browser data, and files from vulnerability researchers, and has been observed targeting high-profile CVEs. The campaign leverages a dependency confusion technique, hiding the malicious payload within a seemingly legitimate Python package.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Mapbox?
Get an email when a new story names Mapbox, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited the trust that security researchers place in open-source repositories by publishing fake proof-of-concept exploit code laced with the ChocoPoC RAT. The campaign used dependency confusion — a technique where a malicious package mimics a legitimate one — to trick researchers into executing malware that steals credentials, browser data, and sensitive files. This is particularly dangerous because vulnerability researchers often handle sensitive information and have elevated access to internal systems. The attack highlights that even technically sophisticated users can be socially engineered when operating in familiar, trusted environments like GitHub.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — mapbox.com
- ip — 91.132.163.78
- malware — ChocoPoC
- malware — gradient.so
- malware — gradient.pyd
- malware — frint
- malware — skytext
- malware — slogsec
- malware — logcrypt.cryptography
- cve — CVE-2025-64446
- cve — CVE-2025-55182
- cve — CVE-2025-14847
- cve — CVE-2026-0257
- cve — CVE-2026-10520
- cve — CVE-2026-50751
- cve — CVE-2026-48908