{"id":1139,"date":"2026-08-19T20:25:47","date_gmt":"2026-08-19T14:55:47","guid":{"rendered":"https:\/\/www.hexnode.com\/threat-watch\/?p=1139"},"modified":"2026-08-19T20:26:14","modified_gmt":"2026-08-19T14:56:14","slug":"chocopoc-malware-trojanized-poc-exploits","status":"publish","type":"post","link":"https:\/\/www.hexnode.com\/threat-watch\/chocopoc-malware-trojanized-poc-exploits\/","title":{"rendered":"ChocoPoC Malware: Trojanized GitHub Exploits Target Security Researchers"},"content":{"rendered":"

A newly discovered malware campaign, ChocoPoC, highlights a growing risk in modern vulnerability research: public proof-of-concept (PoC) exploits can themselves become the attack vector. Rather than compromising the exploit code directly, the campaign weaponized the software supply chain by introducing malicious Python package dependencies into GitHub-hosted PoC repositories.<\/p>\n

For enterprise security teams, vulnerability validation is a routine part of defensive operations. But when PoCs are cloned and executed without verifying their dependencies, researcher workstations and lab systems can become entry points for credential theft, remote access, and broader network compromise. ChocoPoC serves as a reminder that even trusted security workflows require the same level of scrutiny applied to production software.<\/p>\n

Breaking Down the ChocoPoC Attack<\/h2>\n

The ChocoPoC infection chain exploits a workflow that many security professionals use every day: cloning and running public proof-of-concept (PoC) repositories. Instead of embedding malicious code in the exploit itself, the attackers weaponize the PoC’s Python dependency chain. This makes the compromise much harder to detect during routine code reviews.<\/p>\n

When a victim clones and runs a trojanized repository, a malicious Python package named frint is installed. The package then retrieves another package called skytext. During execution, a compiled native Python extension decrypts additional code. It then downloads the final ChocoPoC remote access trojan (RAT) payload from data hosted on Mapbox.<\/p>\n

Once deployed, the malware provides attackers with a broad set of post-compromise capabilities, including:<\/p>\n