ChocoPoC RAT Targeted at Security Researchers via GitHub

A sophisticated supply chain campaign has been identified targeting security researchers and penetration testers who utilize community-shared proof-of-concept (PoC) exploits. The threat actor, referred to as ChocoPoC, weaponizes GitHub repositories for high-profile vulnerabilities by embedding malicious Python dependencies. These dependencies, hosted on PyPI, facilitate a multi-stage infection chain that ultimately deploys the ChocoPoC RAT.

The attack chain involves the installation of a seemingly benign package (e.g., 'frint') that triggers the download of a secondary package ('skytext') containing a compiled Python extension. This extension uses environmental key gating—only executing if a specific filename like 'EXPLOIT_POC.py' is detected—to evade sandbox analysis. The malware utilizes Mapbox datasets as dead-drop resolvers for C2 communication and exfiltration, alongside DoH (DNS-over-HTTPS) to bypass traditional network monitoring.

This campaign is highly impactful as it targets individuals with privileged access and sensitive client data. By compromising researcher environments, attackers can gain access to confidential engagement reports, network configurations, and stored credentials. At least seven major CVEs have been used as lures, including vulnerabilities in FortiWeb, Ivanti Sentry, and PAN-OS.