Trojanized PoCs Target Vulnerability Researchers with ChocoPoC Python RAT

Jul 1, 2026 · Original article ↗

Summary

Researchers identified a campaign using malicious GitHub PoCs and trojanized PyPI dependencies to infect vulnerability researchers and pentesters with ChocoPoC, a persistent Python RAT that steals credentials and files and executes commands.

Key points

At least seven fake CVE proof-of-concept repositories used malicious Python dependencies, including frint and skytext, to deliver the malware.
The infection chain loads an obfuscated native extension, installs persistence through malicious Python packages and .pth files, and retrieves the RAT through a Mapbox dataset.
ChocoPoC steals browser credentials, cookies, autofill data, and history; collects files and system information; and supports arbitrary command and Python-code execution.
The malware uses techniques including environment-specific execution gates, anti-debugging, timestomping, DNS-over-HTTPS, and Mapbox-based command-and-control.
The researchers link related campaigns from 2025 and 2026 with high confidence, citing shared code and infrastructure patterns despite rotating accounts and packages.
Package download statistics suggest the malicious dependencies were installed, but do not establish that those downloads resulted in successful compromises.
The report advises against running the identified PoCs or installing the malicious packages while the malware and infrastructure remain active.

Article Details

Attack Vectors: Trojanised GitHub PoC repositories add malicious Python dependencies to requirements files; installing the PoC dependencies downloads frint and transitively installs skytext.
The skytext native extension decrypts embedded scripts in the PoC runtime, drops a persistent Python RAT, and retrieves additional code from a Mapbox dataset.
ChocoPoC harvests browser credentials and local files, executes received commands or Python code, and exfiltrates data through Mapbox or a dedicated HTTP server.
Defensive Notes: Do not run the identified PoC code or install the malicious packages.
Review PoC authors and every dependency before execution; the article warns that behavior may only trigger in the full PoC runtime and may evade ordinary sandbox analysis.

Indicators of compromise

Type	Indicator	Context
IPV4	`91[.]132[.]163[.]78`	Dedicated external server used for ChocoPoC stage-three data exfiltration.
SHA256	`17997e9e0256d0f5d5d21a4852c37f16b338e4bb9c2bec09bdfd822b24aa76b4`	SHA-256 hash of the malicious frint 0.1.2 wheel.
SHA256	`320b29844892e3c59bc6fcb07e701b2b3230a37cb4a13176174e9e294ec6d43e`	SHA-256 hash of the malicious Linux gradient.so native extension.
SHA256	`40569318e89db751ff3886b2617d990d8a343f0d1d8727b7f978a28129ca36bc`	SHA-256 hash of the malicious Windows gradient.pyd native extension.
SHA256	`5abd45d6f4a1705dca55d882f017d4768888dce9ad99cea40b3da35c23de5cae`	SHA-256 hash listed for the malicious slogsec package.
SHA256	`93739477cd379adef95126b22758c0e644282d2028dd297328ce856fa111dd06`	SHA-256 hash of the malicious skytext 1.1.0 wheel.
URL	`hxxp[:]//91[.]132[.]163[.]78:8001/assets/static/bundle[.]ext[.]min[.]de5b2bc9[.]js`	Chunked-upload endpoint on the server identified for ChocoPoC stage-three data exfiltration.
URL	`hxxps[:]//api[.]mapbox[.]com/datasets/v1/frankley/cmor0tcxf008i1mmpd7apt903/features/dm370543acmdopk296nahbtua?access_token=pk[.]eyJ1IjoiZnJhbmtsZXkiLCJhIjoiY21vNzFzaXNzMDJrMjJxcHJqY3JscnlpYSJ9[.]fuMfMgsxlOGxRy44A-y0WQ`	Specific Mapbox dataset feature URL used as the ChocoPoC dead-drop for retrieving malicious code.
URL	`hxxps[:]//api[.]mapbox[.]com/datasets/v1/mattallahsaed/cmismaye7000s1mp2v8fkn4lp/features/dm370543acmdopk296nahbtua?access_token=pk[.]eyJ1IjoibWF0dGFsbGFoc2FlZCIsImEiOiJjbWlzbWpncWkwNHRmM2ZzMWd1eTBmanQ4In0[.]VNFutzqzaSVfDiwQFr7_gQ`	Specific Mapbox dataset feature URL identified as a ChocoPoC downloader dead-drop.
URL	`hxxps[:]//github[.]com/bolubey/CVE-2026-0257`	Trojanised PoC repository identified as distributing malicious dependencies.
URL	`hxxps[:]//github[.]com/bolubey/CVE-2026-50751`	Trojanised PoC repository identified as distributing malicious dependencies.
URL	`hxxps[:]//github[.]com/lincemorado97/CVE-2025-14847`	Trojanised PoC repository identified as distributing malicious dependencies.
URL	`hxxps[:]//github[.]com/lincemorado97/CVE-2025-55182_CVE-2025-66478`	Trojanised PoC repository identified as distributing malicious dependencies.
URL	`hxxps[:]//github[.]com/lincemorado97/CVE-2025-64446_CVE-2025-58034`	Trojanised PoC repository identified as distributing malicious dependencies.
URL	`hxxps[:]//github[.]com/ogenich/CVE-2026-10520`	Trojanised PoC repository identified as distributing malicious dependencies.
URL	`hxxps[:]//github[.]com/ogenich/CVE-2026-48908`	Trojanised PoC repository identified as distributing malicious dependencies.