New Choco PoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
Summary: Attackers are hiding a data-stealing trojan called ChocoPoC inside Python proof-of-concept repositories on GitHub that claim to exploit new CVEs, and YesWeHack and Sekoia reported on July 1 that the malware and its servers were still live. The malware sits in a Python dependency the PoC pulls in, so the visible code looks clean, and it steals saved passwords, cookies, and files from Chrome, Brave, Edge, and Firefox before giving the attacker a shell; the skytext package alone was downloaded about 2,400 times, mostly on Linux.
Why it matters: The lures target the researchers who supply detections and PoCs to frameworks like Nuclei and MDUT, so poisoning one researcher can push bad code into a framework thousands of others trust. At least seven fake PoC repos were found, and the operator rotated through GitHub, PyPI, and Mapbox accounts, several built from leaked or stolen logins.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Mentions
- CVE-2024-49113
- Related
- Storm Watch | Cyber Podcast | Ivanti's Blast Radius Expands, CFIUS Hack, & Censeye Automates Threat Hunting Cyber Risks ·New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026