ChocoPoC: Fake Exploits on GitHub Are Hunting Security Researchers

A malware campaign is turning the tables on the people who hunt software flaws for a living. Researchers at YesWeHack and Sekoia say attackers are publishing fake proof-of-concept (PoC) exploits for recent vulnerabilities on GitHub. When a security researcher runs one, it quietly installs a remote access trojan called ChocoPoC, which steals passwords, files and browser data and then hands the operators full control of the machine.

Hidden in the dependency chain, not the exploit

The clever part is where the malicious code is not. According to the researchers, nothing suspicious lives in the exploit files themselves, so a quick read of the repository turns up clean. The trap springs only when the victim runs pip install: the PoC pulls in a dependency called frint, which in turn downloads a package named skytext. Inside it sits a compiled module, gradient.so on Linux or gradient.pyd on Windows.

That module activates only when it runs alongside the PoC, and only if it finds a file named EXPLOIT_POC.py or something close to it. Only then does it unpack the payload and load ChocoPoC. Because of this environment gating, running the malicious package on its own in a sandbox does nothing at all: without the rest of the repository, the malware stays dormant.

What ChocoPoC steals

Once active, ChocoPoC behaves like a full remote access trojan. It pulls saved passwords, cookies, autofill data and history from Chrome, Brave, Edge and Firefox. It also collects text files, notes, local databases, command-line history, network settings and the list of running processes. On top of that, the operators can run arbitrary commands and Python code, download entire directories, and pause the malware to avoid drawing attention.

Some of the command names are written in Spanish, and the code contains small mistakes. To the researchers, that suggests it was written by hand rather than generated with AI.

Command and control hidden in Mapbox traffic

For control, ChocoPoC uses a dataset on the mapping service Mapbox, where the addresses of its infrastructure are hidden. The malware fetches its command server address over DNS-over-HTTPS and uses domain fronting, so the traffic looks like ordinary calls to the Mapbox API.

Seven fake repositories, real CVEs

The researchers found at least seven fake repositories, each claiming to hold an exploit for a real, recent vulnerability:

• FortiWeb (CVE-2025-64446)
• React2Shell (CVE-2025-55182)
• MongoBleed (CVE-2025-14847)
• PAN-OS (CVE-2026-0257)
• Ivanti Sentry (CVE-2026-10520)
• Check Point VPN (CVE-2026-50751)
• Joomla SP Page Builder (CVE-2026-48908)

The skytext package used in the attacks was downloaded around 2,400 times, mostly by Linux users. Downloads alone do not reveal how many machines were infected, but the researchers note that the peaks lined up with the disclosure of serious vulnerabilities.

Not the first wave

The campaign appears to date back to late 2025, when the attackers used almost identical packages named slogsec and logcrypt.cryptography. The same operators are very likely behind both waves, since the code carried repeating markers tied to the command infrastructure. Throughout, they kept rotating their GitHub, PyPI and Mapbox accounts, and some of those accounts may have been hijacked or created with stolen credentials.

How to protect yourself

Sekoia's takeaway is blunt: treat every PoC exploit as potentially dangerous, inspect the entire dependency chain, and avoid packages published by unknown or newly created accounts. Because even running an exploit inside a virtual machine does not guarantee that ChocoPoC will reveal itself, the safest move is not to install suspicious dependencies at all.

The researchers also recommend checking systems for frint, skytext, slogsec and logcrypt.cryptography. If any of them has run, they advise rotating your credentials and fully reinstalling the system.

Based on research by YesWeHack and Sekoia.