Malware
ChocoShell
- First Reported
- Aug 11, 2026
- Latest Reported
- Aug 20, 2026
Reported Context (2)
- Samples of the CHERRYPIE PowerShell infostealer (also known as ChocoShell) contain numerous artifacts suggesting the malware is generated by a large language model (LLM). Google Details Russian Espionage Clusters Abusing Authentication Flows to Target Individuals
- to support a significant portion of its operations, including the development of the CornFlake and ChocoShell malware. This assessment is based partly on extensive and unusually detailed comments found in the Midnight Blizzard-Linked Campaign Abuses Hotel Wi-Fi Portals to Steal Microsoft 365 Credentials
Malware (7)
People (2)
Threat Actors (7)
MITRE ATT&CK (10)
Vendors (3)
Products (8)
Industries (10)
Countries (6)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.