ChocoPoC: trojanized GitHub PoC repos hide a Python RAT in the requirements.txt, targeting vulnerability researchers

ChocoPoC is a Python remote access trojan delivered through fake proof-of-concept (PoC) exploit repositories on GitHub, aimed squarely at the people who download exploits for a living: vulnerability researchers. The clever part is where the malware lives. It is not embedded in the exploit script — a researcher reading the code would not spot it. Instead, the operator adds a malicious package to the PoC's dependency list, hosted on PyPI. When the researcher runs pip install to stand up the exploit environment, a compiled native Python extension loads and the RAT is on the box. First reported by Sekoia, with tier-1 coverage from The Hacker News and BleepingComputer.

What we know

• Late 2025 – 2026 — Multiple waves of trojanized PoC repositories are observed; investigators link them to a single actor reusing an "opsec" kit across campaigns.
• 2026-07-01/02 — Sekoia publishes analysis; The Hacker News and BleepingComputer report the campaign. At least seven GitHub PoC repos are identified.
• The malicious PyPI package skytext is reported downloaded roughly 2,400 times, mostly on Linux, with download spikes following disclosure of popular vulnerabilities.

Source-layer flag: the RAT capabilities, the seven-repo count, the skytext download figure, and the Mapbox dead-drop C2 are reported from Sekoia and tier-1 press; we have not independently analyzed the malware sample or confirmed the PyPI artifact.

Payload mechanics

The delivery chain inverts the usual "read the code before you run it" defense. Researchers routinely audit the exploit file itself — but far fewer scrutinize the requirements.txt and the transitive dependencies that pip install pulls. ChocoPoC exploits exactly that gap: the fake exploit's dependency list includes a malicious PyPI entry; installing it loads a compiled native extension that is the RAT.

To make each wave credible, the operator hosts PoCs for genuinely current, high-interest CVEs, timing releases to disclosure spikes. Reported lures span: FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908).

Once resident, ChocoPoC is a full-featured RAT — file exfiltration, browser-credential harvesting, and arbitrary command execution — hardened with evasion: timestomping, file-lock mutexes, PEB walking, export hashing, and anti-debugging. C2 is staged as a Mapbox dead-drop, with reused Mapbox feature IDs among the clustering signals.

Source-layer flag: CVE lures, evasion techniques, and C2 tradecraft above are reported from Sekoia's writeup, not independently reverse-engineered here.

The target selection is deliberate and compounding: compromise the researchers, and you get early access to exploit development, credentials into security orgs, and a trusted position from which the next batch of poisoned PoCs looks even more legitimate.

Indicators of compromise

Malicious PyPI package: skytext (~2,400 downloads; remove and audit any environment that installed it).

Delivery: GitHub "PoC exploit" repositories whose requirements.txt pulls an unfamiliar package that ships a compiled native extension.

CVE lures used as bait: CVE-2025-64446 (FortiWeb), CVE-2025-55182 (React2Shell), CVE-2025-14847 (MongoBleed), CVE-2026-0257 (PAN-OS), CVE-2026-10520 (Ivanti Sentry), CVE-2026-50751 (Check Point VPN), CVE-2026-48908 (Joomla SP Page Builder).

C2: api.mapbox[.]com abused as a dead-drop channel (reused Mapbox feature IDs across waves).

Host tradecraft: timestomping, file-lock mutexes, PEB walking, export hashing, anti-debugging — presence of these in a Python-loaded native extension is a strong signal.

Detection and mitigation

• Never run untrusted PoCs on a real endpoint. Detonate exploit code — and its pip install — only in a disposable, network-isolated VM or container.
• Audit dependencies before install: read requirements.txt and pin/verify every package; treat an unfamiliar dependency in an "exploit" repo as hostile by default.
• Search build/research hosts for the skytext package and for outbound connections to api.mapbox[.]com from Python processes that have no legitimate mapping use.
• Rotate credentials (browser-stored, cloud, SSH) on any researcher host that ran one of these PoCs; assume browser-credential theft.
• Egress-monitor research subnets for dead-drop-style C2 riding legitimate SaaS APIs.

Attribution

Investigators attribute the waves to a single actor based on operational reuse — shared Mapbox feature IDs, identical hashing gates, and consistent persistence techniques across late-2025 and 2026 campaigns. No named group or nation-state is asserted in the reporting reviewed. What is claimed: one operator, reusing an opsec kit, deliberately targeting security researchers. What is not claimed: a specific APT identity or state sponsor. Confidence in the single-actor clustering is inferred (behavioral, per Sekoia); confidence in any further identity is unknown. Researcher-targeting has historical precedent with DPRK-nexus activity, but no such link is claimed here.

Criminal-market signal

Bounded negative (evidenced): on 2026-07-03 we swept ~25 dark-web search engines over Tor for ChocoPoC and the malicious PyPI package skytext; ~44 pages were crawled across both terms and zero were flagged relevant. No criminal-market listing or forum discussion was found on the venues our pipeline can see (closed forums and Telegram are out of scope). The campaign profile is operator-run, not commodity: bespoke researcher-targeting with a reused private opsec kit and a dead-drop C2 is the signature of an operator using the tooling for access, not selling it on forums (the H2 pattern, consistent with our Shai-Hulud/TeamPCP framing). Absence of a marketplace listing therefore does not reduce risk — detection belongs at the developer-workstation and PyPI-dependency layer, not criminal-market monitoring.

CISO translation

Attackers are publishing fake "exploit code" on GitHub that hides malware inside the Python packages it installs, specifically to infect security researchers who download and test it. This matters to us because our own security and engineering staff routinely pull down PoC exploits, and one careless pip install on a work machine can hand over browser passwords, cloud keys, and remote control of that host. Mandate that all untrusted exploit code — including its dependency install — runs only in throwaway isolated VMs, and audit any research host that recently installed the package skytext. Confidence is high that the campaign is real and active (independent vendor analysis, seven identified repos, thousands of downloads), though the specific operator is not named. The cost of inaction is the compromise of the very people who hold our security keys — a foothold that is unusually damaging because it lands inside the security team itself.