ChocoPoC RAT Hides in Fake Python PoCs to Steal Researchers’ Data
Summary
YesWeHack and Sekoia found ChocoPoC RAT hidden in dependencies of at least seven fake GitHub Python PoCs. It steals browser data and files, enables remote commands, and uses Mapbox and DNS-over-HTTPS for C2; downloads do not confirm infections.
Key points
- YesWeHack and Sekoia reported at least seven fake Python PoC repositories tied to high-profile CVEs; downloads alone do not establish that anyone was infected.
- Installing a PoC can pull in frint and then skytext, whose compiled payload activates when it detects the real PoC loaded.
- ChocoPoC can steal browser passwords, cookies, autofill data, history, files, local databases, and shell history.
- The RAT supports shell commands, arbitrary Python execution, folder retrieval, and slowing its activity to avoid attention.
- It retrieves commands from a dataset on Mapbox using DNS-over-HTTPS and domain fronting; larger uploads go to 91.132.163.78.
- The researchers said the malware and its servers were still live when they reported their findings. They advise avoiding unknown PoCs and packages, reviewing dependency chains, and rotating credentials and rebuilding hosts if affected packages were run.
Article Details
- Attack Vectors
- Fake Python proof-of-concept repositories on GitHub install the malicious frint package, which pulls in skytext as a dependency.
- The skytext package includes a compiled file that activates when the real PoC is loaded, unpacks its payload, and downloads ChocoPoC.
- ChocoPoC uses a dataset on Mapbox as a command-and-control dead drop and uses domain fronting; larger uploads go to a separate server.
- Defensive Notes
- Treat proof-of-concept code as hostile and avoid running code from new or unknown accounts.
- Review the full dependency chain and watch for newly published packages, unfamiliar maintainers, and accounts with little history.
- Do not install the packages frint, skytext, slogsec, or logcrypt.cryptography; the article recommends checking systems for them.
- If any of the packages were run, rotate credentials and rebuild the host. Testing in a throwaway VM alone may not trigger the malware.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 91[.]132[.]163[.]78 | Separate server used by ChocoPoC for larger uploads. |
MITRE ATT&CK
T1005 · Data from Local SystemChocoPoC collects local files, notes, databases, and shell history.T1059.006 · PythonThe attacker can use ChocoPoC to run arbitrary Python.T1090.004 · Domain FrontingThe article says ChocoPoC uses domain fronting to make its traffic look like ordinary Mapbox API calls.T1102.001 · Dead Drop ResolverChocoPoC reads commands from a dataset on Mapbox used as a dead drop.T1105 · Ingress Tool TransferThe activated skytext component downloads the ChocoPoC payload.T1195.001 · Compromise Software Dependencies and Development ToolsThe fake Python PoCs install malicious packages through a dependency chain: frint pulls in skytext.T1204.002 · Malicious FileThe infection chain begins when a researcher clones and runs a fake exploit PoC.T1539 · Steal Web Session CookieChocoPoC steals browser cookies.T1555.003 · Credentials from Web BrowsersChocoPoC steals saved passwords from Chrome, Brave, Edge, and Firefox.
Threat Actors
Malware
ChocoPoCAttackers are hiding the ChocoPoC data-stealing trojan inside fake Python exploit repositories that target security researchers rushing to test new CVEs.WebRATresearcher data in early 2025, and a separate campaign pushed fake CVE PoCs carrying a trojan called WebRAT in late 2025, mostly hitting students and junior testers.
Products
BraveIt pulls saved passwords, cookies, autofill, and history from Chrome, Brave, Edge, and Firefox.EdgeIt pulls saved passwords, cookies, autofill, and history from Chrome, Brave, Edge, and Firefox.GitHub#ChocoPoCGoogle ChromeIt pulls saved passwords, cookies, autofill, and history from Chrome, Brave, Edge, and Firefox.MapboxThe malware steals browser credentials and files, then uses dependency chains, Mapbox, and other infrastructure to stay hidden while spreading through malicious PoCs.Mozilla FirefoxIt pulls saved passwords, cookies, autofill, and history from Chrome, Brave, Edge, and Firefox.PyPI#ChocoPoC