ChocoPoC RAT: When the Exploit Itself Is the Trap

Introduction

Researchers from YesWeHack and Sekoia TDR disclosed on July 1, 2026, an active infection campaign distributing a remote access trojan (RAT) named ChocoPoC. Unlike traditional campaigns that directly target unpatched production servers, this operation exploits a different, and particularly sensitive, link in the security chain: the very workflows of vulnerability researchers and pentesters. The attackers distribute trojanized Proof of Concept (PoC) repositories on GitHub, taking advantage of the pressure and urgency with which the security community tends to test exploits for newly disclosed CVEs. By running these supposed PoCs, the victim unknowingly installs a malicious Python dependency that delivers the ChocoPoC payload, giving the threat actors remote control over the compromised development environment.

What is ChocoPoC RAT?

ChocoPoC is a fully functional RAT written in Python, designed to operate stealthily within research and development environments (researchers, red teamers, and vulnerability analysts). Its main capabilities include:

• Remote command execution: allows operators to issue arbitrary instructions on the compromised machine, essentially obtaining a remote shell.
• Sensitive data exfiltration: extracts files, notes, local databases, shell history, and network configurations from the victim machine.
• Browser credential theft: collects saved passwords, session cookies, autofill data, and browsing history from Chrome, Brave, Edge, and Firefox.
• Advanced persistence and evasion: incorporates anti-analysis techniques such as timestomping (altering file metadata), file-locking mutexes, PEB walking, export hashing, and anti-debugging mechanisms.

The impact on an organization is severe: since the vector directly targets offensive security teams, the compromise exposes not only general corporate information but also intelligence about vulnerabilities the organization itself was investigating or testing, credentials for access to critical testing infrastructure, and potentially privileged access to clients in the case of pentesting firms.

How does it work?

Attack vector:

Initial entry does not occur through direct exploitation of a CVE on an exposed system, but through social engineering targeted at researchers. The attackers publish GitHub repositories presented as functional PoCs for critical, newly announced vulnerabilities. The visible PoC code looks legitimate and clean; the malicious component is hidden inside a third-party Python dependency (packages identified so far include frint, skytext, slogsec, and logcrypt.cryptography) that the PoC script itself imports automatically, evading a superficial code review.

Activation and persistence mechanism:

ChocoPoC includes an environmental-key “gating” mechanism: the payload computes a hash of the base names of all Python modules loaded at runtime and only activates if it detects the exact signature of the specific exploit script that accompanies it. This means that if the package is run in a standard sandbox or automated analysis environment without the corresponding “decoy” script, the malware remains completely dormant, making it harder for conventional dynamic-analysis tools to detect.

Communication with the C2:

One of ChocoPoC’s most distinctive features is its domain fronting technique using the legitimate Mapbox API. The downloader establishes an HTTPS connection by forcing the Server Name Indication (SNI) field to api.mapbox.com, blending command-and-control traffic with legitimate traffic from that platform and making it harder to detect through network traffic inspection. The RAT continuously polls this channel (leveraging Mapbox datasets as a “dead drop” mechanism) to receive instructions, and falls back on a dedicated external HTTP server when it needs to exfiltrate larger volumes of data.

Affected Systems and Environments

• Security development and research environments: workstations of vulnerability researchers, pentesters, and Red Team members who download and run public PoCs.
• PyPI (Python Package Index) ecosystem: malicious packages published under names that mimic legitimate utilities (frint, skytext, slogsec, logcrypt.cryptography).
• Public GitHub repositories: at least seven fake PoC repositories identified so far, all following the same modus operandi.
• Cross-platform systems: being written in Python, the RAT can potentially run on Windows, Linux, and macOS, widening its impact surface beyond a single operating system.
• Corporate web browsers: Chrome, Brave, Edge, and Firefox, as a source of stolen credentials and session cookies.

Mitigation and Detection

Priority remediation recommendations:

• Treat every public PoC as untrusted code until it has been thoroughly vetted, including all of its declared dependencies (not just the visible main file).
• Isolate PoC execution in disposable virtual machines with no access to corporate credentials, keeping in mind that isolation alone is not sufficient against this RAT, since its main goal is data and credential exfiltration rather than persistence in production infrastructure.
• Audit the reputation of repositories and packages before installing them: maintainer account age, commit history, and the author’s prior activity.
• Monitor outbound connections during testing of any exploit script, paying special attention to HTTPS traffic with SNI pointing to api.mapbox.com that does not correspond to a known, legitimate use of that API by the team.
• Remove and block the identified packages (frint, skytext, slogsec, logcrypt.cryptography) in the organization’s development environments.

Searching for Indicators of Compromise (IoCs):

Incident response (IR) teams should prioritize searching for:

• Malicious PyPI package names listed above installed in Python virtual environments (pip list, requirements.txt, dependency lock files).
• Anomalous network traffic with forced SNI toward api.mapbox.com that does not match the organization’s normal use of mapping services.
• Long-running Python processes launched from PoC project directories or temporary exploit-research folders.
• Compromised GitHub accounts associated with commits to PoC repositories, since Sekoia found evidence that several maintainer accounts were taken over via leaked credentials or prior infostealers.
• Because file hashes and C2 infrastructure addresses change with each wave of the campaign, IR teams are advised to check and sync their intelligence feeds with the full technical indicators (SHA-256 hashes, exfiltration server IPs) published in the original joint report by YesWeHack and Sekoia (see references).

Recap

The ChocoPoC case clearly illustrates how quickly malware operators adapt their delivery techniques to exploit not the technical vulnerabilities of a piece of software, but the operational habits and urgency of the people working to defend against them. By hiding the payload in a PoC’s dependency rather than in the exploit file itself, the attackers managed to slip into a blind spot of trust: the security community tends to review a PoC’s main script, but rarely audits the full dependency tree it imports. The result is a threat that requires no zero-day vulnerability against the operating system or the network, but instead uses the very discipline of vulnerability research as its delivery vector. This reinforces a core principle of current threat intelligence: an organization’s most critical attack surface can, paradoxically, be its own technical staff’s workflow.

References

The Hacker News. (2026, July 3). New ChocoPoC RAT targets vulnerability researchers via fake PoC exploit repos. https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html

BleepingComputer. (2026, July 1). New ChocoPoC malware targets researchers via trojanized PoC exploits. https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/

Sekoia. (2026, July 1). Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits. https://www.sekoia.com/blog/dont-eat-the-chocopocs-how-vulnerability-researchers-were-repeatedly-targeted-by-trojanised-exploits

YesWeHack. (2026, July 1). Don’t eat the ChocoPoCs! Vulnerability researchers were targeted by trojanised exploits. https://www.yeswehack.com/news/chocopocs-vulnerability-researchers-trojanised-exploits

CyberPress. (2026, July 2). Hackers hide ChocoPoC malware in Python dependencies to compromise pentesters. https://cyberpress.org/chocopoc-targets-python-dependencies/