A newly identified malware campaign named ChocoPoC is targeting cybersecurity researchers and enterprise vulnerability management teams. By burying malicious PyPI transitive dependencies in proof-of-concept exploit repositories, the threat actors execute remote commands and exfiltrate browser credentials.
Social engineering lures with fake GitHub CVE PoCs
pip install pulls malicious frint and skytext from PyPI
gradient.pyd/so extension checks for running exploit module
Drops trojanized site-packages files with timestomping
Asynchronous Mapbox C2 polling; exfiltrates data to 91.132.163.78
If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.
June 24, 2026
A substantial data leak involving Be Call Group, a contact center BPO partner of TIGO Colombia, has exposed 1 GB of data containing 9.7 million records and direct connection credentials. Discover how attackers abuse third-party trust relationships and how to protect your enterprise network.
A targeted cyber campaign has exposed credentials and personally identifiable information belonging to prominent digital advocacy leaders. The threat actor is leveraging encrypted peer-to-peer messaging networks to distribute the stolen data, highlighting persistent cognitive warfare threats.
An 8 GB SQL database archive has been leaked online, exposing sensitive student records, institutional identifiers, and emails. The incident highlights critical security gaps in public-facing educational platforms and the immediate danger of secondary credential abuse attacks across enterprise environments.
Compromised security workstations directly expose an enterprise to catastrophic supply chain breaches, credential theft, and unauthorized lateral movement within internal networks. Because vulnerability researchers and penetration testers maintain privileged access to internal source repositories, testing environments, and sensitive client reports, targeting their local systems represents a high-impact strategy for sophisticated threat actors. The newly identified ChocoPoC malware campaign exploits this exact operational vector, distributing a Python-based remote access trojan (RAT) through trojanized proof-of-concept (PoC) exploit repositories on GitHub. By poisoning dependencies rather than modification of the exploit code itself, the campaign successfully circumvents traditional code-review practices and automated sandbox environments, leading to the silent extraction of browser credentials, local files, and system configurations.
In the Gulf Cooperation Council (GCC) region, where rapid digitalization has placed cybersecurity at the forefront of regulatory compliance and operational resilience, protecting security engineering workflows is paramount. Modern enterprise teams often download public exploits to test their own systems as part of standard Vulnerability Management activities. However, running unchecked scripts on local corporate-joined devices introduces acute risks that extend far beyond a single workstation.
Understanding the complex behavior of ChocoPoC requires a deep dive into its distinct stages of execution, from initial user execution to stealthy command-and-control (C2) communication.
If an endpoint shows signs of ChocoPoC activity, immediate containment is mandatory:
Isolate the Endpoint: Disconnect the compromised system from the network immediately to sever the Mapbox C2 link and halt active credential exfiltration.
Invalidate All Session Credentials: Since the Trojan specializes in browser credential harvesting, assume all saved passwords, active cookies, VPN credentials, SSH keys, and SaaS session tokens on that machine are compromised. Force password resets and revoke active sessions across all enterprise platforms.
Purge and Rebuild Python Environments: Clean the local system by completely deleting compromised Python directories, or ideally, perform a full operating system re-image to ensure no backdoor processes remain.
Enforce Safe Execution Policies: Update standard operating procedures to mandate that all third-party, unverified security tools and public exploit scripts must only be executed within isolated, non-domain-joined, ephemeral virtual machines.
The threat actors behind the ChocoPoC campaign build highly polished, seemingly authentic GitHub profiles that pretend to belong to legitimate security researchers, white-hat bug hunters, or independent pentesting teams. They upload proof-of-concept exploit code for critical, high-severity vulnerabilities that security teams are actively trying to remediate. To maximize reach, the attackers advertise these repositories on developer forums, social platforms, and within GitHub issue threads.
When a researcher clones a repository and reviews the main Python exploit file, the script appears completely harmless. No malicious payloads or obfuscated strings are embedded within the core script. Instead, the attackers hide the execution trigger in the requirements.txt file. This file lists an external dependency on a custom, malicious Python Package Index (PyPI) package named frint (specifically version 0.1.2). When the researcher executes pip install -r requirements.txt, Python downloads frint, which secretly pulls down a secondary malicious transit dependency named skytext (version 1.1.0). In earlier historical iterations, the attackers utilized alternate packages like slogsec and logcrypt.cryptography.
The core payload in the skytext library is a precompiled Python native extension: gradient.pyd for Microsoft Windows environments and gradient.so for Linux. When Python loads the compiled module, the extension initializes and immediately performs environmental key gating to evade detection. It hashes the basenames of all active Python modules and checks whether the designated exploit script is currently running. If the extension is detonated in an isolated, automated sandbox without the context of the full exploit script name running, it remains completely dormant. This sophisticated evasion technique ensures that automated malware analysis engines classify the PyPI packages as clean.
Once the gating checks are validated, the precompiled native extension decrypts five embedded payloads using Zlib decompression. The malware establishes robust persistence by targeting the Python environment itself. It drops a trojanized version of the _distutils_hack package into the local Python site-packages directory and writes malicious .pth (Python Path) files. To further evade forensic detection, the malware timestomps these newly written files, backdating their timestamps to match legitimate system libraries. Because of these changes, a hidden Python process automatically runs and imports choco.py (the Stage 2 downloader) every single time any Python interpreter is launched on that workstation.
The choco.py downloader script initializes communication by resolving api.mapbox.com using DNS-over-HTTPS (DoH). It leverages custom HTTP headers to perform domain fronting and fetches a Base64-encoded dataset feature from Mapbox containing the final-stage ChocoPoC RAT. Once executing in-memory, the RAT continuously polls Mapbox datasets for tasks, effectively abusing legitimate Mapbox APIs as an asynchronous C2 channel. Small files and operational status reports are sent back directly through Mapbox datasets, while larger, bulk exfiltrated data (such as web browser credential databases) are exfiltrated to a dedicated external server hosted at 91.132.163.78 over port 8001.
The campaign is highly opportunistic, constantly changing its GitHub lures to match recently disclosed, high-visibility vulnerabilities. Researchers looking to validate patches or demonstrate risk internally are the primary targets. The specific CVE lures utilized in this campaign include:
CVE-2025-64446: A critical Fortinet FortiWeb Path Traversal vulnerability.
CVE-2025-55182: An execution flaw known as React2Shell.
CVE-2025-14847: A high-impact MongoBleed flaw affecting MongoDB deployments.
CVE-2026-0257: A Palo Alto Networks PAN-OS GlobalProtect Authentication Bypass.
CVE-2026-10520: An Ivanti Sentry Command Injection vulnerability.
CVE-2026-50751: A Check Point Security Gateway Improper Authentication bug.
CVE-2026-48908: A Joomla SP Page Builder Remote Code Execution flaw.
Compromising a security researcher's system is a goldmine for advanced adversaries. Researchers regularly store highly sensitive materials, including corporate source code from Source Code Review assignments, raw API keys, active cloud tokens, internal architecture diagrams, and credential databases. Once the ChocoPoC RAT establishes a foothold, it targets stored session cookies and web browser credentials. This immediately compromises the developer's entire identity, leading to downstream supply chain attacks.
If the domain already looks exposed, use Dark Web Scanner before requesting a full report.
To prevent such compromises, organizations must strictly monitor their external attack surfaces and validate how internal teams execute open-source tools. Employing continuous offensive security protocols, such as comprehensive Penetration Testing or dedicated Red Team Operations, ensures that your detection pipelines can catch lateral movement before threat actors exploit compromised internal credentials.
To mitigate the risks associated with the ChocoPoC campaign, security operations center (SOC) teams should implement the following specific detection and response guidelines:
Monitor Python Path Modifications: Set up endpoint detection rules to alert on the creation or modification of .pth files within any local Python site-packages directory. Legitimate workflows rarely drop dynamic path configuration files during runtime.
Audit Distutils Integrities: Routinely scan and verify the file integrity of the _distutils_hack library and the default __init__.py files. Look for mismatching creation times (timestomping indicators).
Identify Spawning Anomalies: Alert on any Python subprocess that spawns command-line utilities (such as cmd.exe, powershell.exe, bash, or sh) accompanied by anomalous environment variables like ZEBUWIAKGPHOQAP006=PTsjBGKQUxZorq2 or JKHWQVEKRASDF12=JKHKJ23VAS8DF9.
Mapbox C2 Activity: Implement firewall and web proxy rules to inspect outbound HTTPS traffic targeting api.mapbox.com. Track connections initiated by non-browser user agents (like Python's HTTP library) that pass custom tokens or query datasets associated with accounts such as frankley, mattallahsaed, james09790, or rdraa.
Direct Bulk Uploads: Block and alert on all outbound connections attempting to reach the IPv4 address 91.132.163.78, particularly on port 8001, which acts as the campaign's dedicated exfiltration endpoint.