ChocoPoC RAT Targets Researchers Through Trojanized GitHub PoCs
Summary
Sekoia found GitHub PoC repositories delivering the ChocoPoC RAT through malicious PyPI dependencies. The malware can run commands and collect files and browser data; researchers say the campaign likely used compromised accounts.
Key points
- Sekoia identified at least seven malicious GitHub PoC repositories distributing ChocoPoC, a Python-based RAT.
- Installing a repository fetches the malicious frint package, which pulls skytext; when the PoC runs, skytext decrypts code that downloads ChocoPoC from a Mapbox dataset.
- ChocoPoC can run shell commands and Python code, upload files, collect browser data and files, gather shell history and network configuration, and enumerate processes.
- Sekoia says Mapbox datasets are also abused for data exfiltration, with larger uploads handled separately through an HTTP server.
- The repositories impersonated PoCs for seven products or vulnerabilities, and skytext was downloaded about 2,400 times, mostly on Linux systems.
- Researchers found earlier packages with similar code delivering the same payload and assess with high confidence that the attacker used compromised accounts to publish packages and PoCs.
- Sekoia recommends treating unverified repositories as untrusted and running unverified code in isolated environments.
Article Details
- Attack Vectors
- Weaponized GitHub proof-of-concept repositories for multiple vulnerabilities deliver the ChocoPoC RAT through malicious PyPI dependencies rather than embedding the malware in the exploit files.
- Cloning a malicious repository installs the trojanized frint package, which pulls in skytext; executing the PoC triggers a compiled extension that decrypts Python code and downloads ChocoPoC from a Mapbox dataset.
- Sekoia assesses with high confidence that the attacker primarily used compromised accounts to publish malicious PyPI packages and PoCs.
- ChocoPoC can execute shell commands and Python code, collect browser data and local files, enumerate processes, and gather network configuration. Mapbox datasets are also abused for exfiltration, with larger uploads handled separately via an HTTP server.
- Defensive Notes
- Do not blindly trust GitHub repositories or unverified proof-of-concept code.
- Execute unverified code only in isolated environments.
MITRE ATT&CK
T1005 · Data from Local SystemChocoPoC searches for and collects files, including text, Markdown documentation, and database files.T1016 · System Network Configuration DiscoveryChocoPoC collects network configuration from the host.T1057 · Process DiscoveryChocoPoC enumerates running processes.T1059.004 · Unix ShellChocoPoC can execute arbitrary shell commands.T1059.006 · PythonThe skytext extension decrypts embedded Python code, and ChocoPoC can execute arbitrary Python code.T1083 · File and Directory DiscoveryChocoPoC searches the host for specified file types and can upload files and directories.T1105 · Ingress Tool TransferThe decrypted code triggers a downloader that retrieves the ChocoPoC payload from a Mapbox dataset.T1195.001 · Compromise Software Dependencies and Development ToolsThe ChocoPoC delivery chain uses malicious PyPI dependency packages, including frint and skytext, in trojanized proof-of-concept repositories.T1555.003 · Credentials from Web BrowsersChocoPoC collects browser passwords, cookies, autofill data, and browsing history.T1567 · Exfiltration Over Web ServiceThe article reports that Mapbox datasets are abused to exfiltrate data.
CVE
CVE-2025-14847MongoDB Inc. · MongoDB ServerChocoPoC and host exploits for FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), andCVE-2025-55182Meta · react-server-dom-parcel; Meta · react-server-dom-turbopack; +1 moreon GitHub that distribute ChocoPoC and host exploits for FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check PointCVE-2025-64446Fortinet · FortiWebat least seven PoC repositories on GitHub that distribute ChocoPoC and host exploits for FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti SentryCVE-2026-0257Palo Alto Networks · PAN-OS; Palo Alto Networks · Prisma Access; +1 morefor FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page BuilderCVE-2026-10520ivanti · SentryReact2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908).CVE-2026-48908joomshaper.net · SP Page Builder extension for JoomlaIvanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908).CVE-2026-50751checkpoint · Quantum Security Gateway; checkpoint · Spark FirewallsMongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908).
Malware
Products
GitHubSekoia uncovered weaponized GitHub proof-of-concept repositories that deliver the ChocoPoC Python RAT by hiding malicious behavior inside PyPI dependencies like frint and skytext.PyPISekoia uncovered weaponized GitHub proof-of-concept repositories that deliver the ChocoPoC Python RAT by hiding malicious behavior inside PyPI dependencies like frint and skytext.