ChocoPoC Malware Hides in Fake GitHub Exploit Code

The people who hunt software vulnerabilities for a living are, this week, the targets. On July 1, 2026, researchers at YesWeHack and Sekoia published joint findings on a data-stealing trojan they’ve named ChocoPoC, distributed inside fake proof-of-concept (PoC) exploit repositories on GitHub. The lure is precise: repos that claim to contain working exploit code for hot, freshly disclosed CVEs — exactly the kind of thing a security researcher or penetration tester would clone and run without a second thought. As of the report, the researchers warned, the malware and its command infrastructure were still live.

The bait: exploits for the CVEs everyone wants

The campaign weaponizes urgency. When a critical vulnerability drops, defenders and red-teamers race to understand it, and a public PoC is the fastest way to do that. The attackers seeded at least seven GitHub repositories posing as exploits for high-profile flaws, including FortiWeb (CVE-2025-64446), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908), among others.

Each repo looks legitimate at a glance — plausible exploit logic, a README, the trappings of real research. That’s the point. The malicious behavior isn’t in the code the victim reads. It’s in what the code quietly pulls in.

How the attack works

The infection chain is built to survive a quick code review. When a victim clones one of the malicious repositories and runs the PoC, a trojanized Python package named frint is automatically fetched and installed as a dependency. During installation, frint pulls a second malicious package, skytext, which ships a compiled native Python extension.

That compiled extension is the trick. Because the malicious logic lives in a binary rather than in readable Python source, skimming the repo’s .py files reveals nothing suspicious. When the PoC executes, the extension runs automatically, decrypts additional embedded Python, and triggers a downloader that retrieves the final payload — ChocoPoC itself — from a Mapbox dataset.

Using a legitimate mapping service as a dead drop is the campaign’s cleverest piece of tradecraft. ChocoPoC reads its instructions from a dataset hosted on Mapbox, resolving the address over DNS-over-HTTPS and employing a domain-fronting technique so the traffic blends in with ordinary Mapbox API calls. To a network monitor, an infected machine looks like it’s just loading maps.

What it steals

Once resident, ChocoPoC is a full remote-access trojan with a broad reach. According to the researchers, it pulls saved passwords, cookies, autofill data, and browsing history from Chrome, Brave, Edge, and Firefox — the credential troves that, for a security professional, can unlock internal tools, cloud consoles, and client environments.

Beyond browsers, it collects text files, notes, local databases, shell history, network settings, and the list of running processes. And it hands the operator live control: the ability to run arbitrary shell commands, execute Python, exfiltrate entire folders, and throttle its own activity to stay quiet and evade detection. For a compromised researcher, the blast radius extends well past their own laptop to every system their stolen credentials can reach.

Why researchers are the perfect target

There’s a grim logic to aiming at the security community. Researchers routinely run untrusted, hostile-by-design code — that’s the job. Their machines hold privileged access to bug-bounty platforms, disclosure pipelines, and client networks. And the norm of grabbing a public PoC to reproduce a finding creates a standing supply of victims who will actively seek out and execute exactly the files an attacker wants them to run.

This is a textbook software supply-chain attack, just aimed at an unusually valuable population. The dependency mechanism — a clean-looking package that silently pulls a malicious one — is the same pattern that has plagued open-source registries for years. What’s new is the targeting and the polish: native-code payloads to defeat source review, and a legitimate cloud service repurposed as covert DNS-fronted command-and-control.

What it means

ChocoPoC is a reminder that “run it in a sandbox” isn’t optional advice — it’s the baseline. But it also raises harder questions about trust in the tools researchers rely on every day.

For practitioners. Treat any PoC repository as hostile until proven otherwise. Clone into an isolated, disposable virtual machine with no saved credentials and no network path to anything that matters. Scrutinize dependencies, not just the headline script — the danger here lived entirely in packages the PoC pulled in, one of them a compiled binary that source review would never catch. Pin and vet transitive dependencies before execution, and assume that a repo exploiting a trendy new CVE is disproportionately likely to be a trap.

For the ecosystem. The abuse of a compiled Python extension to hide behavior, and of Mapbox as a domain-fronted dead drop, shows how attackers keep folding legitimate infrastructure into their kill chains — which makes detection by network signature alone a losing game. GitHub and package registries face the same enforcement problem they always have: malicious repos and packages are cheap to spin up and easy to re-seed after takedown.

What to watch. With the infrastructure reported as still active, expect the operators to rotate to new repo names and freshly trending CVEs. The pattern — impersonate an exploit for whatever critical flaw is dominating the headlines — is durable, and the next wave will simply swap in the next big vulnerability. The defensive habit that actually scales is boring but effective: never run untrusted exploit code anywhere it can touch something you can’t afford to lose.