Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs.
Run one, and it quietly lifts your saved passwords, browser cookies, and files, then hands the attacker a shell on your machine. YesWeHack and Sekoia published their joint findings on July 1 and warned that, as of that report, the malware and its servers were still live, so do not run any of these PoCs.
The trick is where the code sits. The visible PoC looks clean. The malware hides in a Python package that the PoC pulls in as a dependency, so it slips past a quick code review.
How the trap works
The bait is time pressure. When a big flaw drops, researchers race to test it and grab community PoCs to move fast. This campaign turns that habit into an infection route.
The chain, in plain terms:
- You clone the repo and run pip install to fetch the PoC’s requirements.
- That pulls in a package named frint, which in turn drags in a second package, skytext.
- skytext ships a small compiled file (gradient.so on Linux, gradient.pyd on Windows) that runs the moment you launch the PoC.
- It only wakes up when it sees the real PoC loaded, checking for a file named EXPLOIT_POC.py or similar, then unpacks its payload and downloads the trojan.
That last check is why a plain sandbox sees nothing. Detonate the package on its own, without the full PoC around it, and the malware stays asleep.
What it steals and does
Once running, ChocoPoC is a full remote access trojan. It pulls saved passwords, cookies, autofill, and history from Chrome, Brave, Edge, and Firefox. It grabs text files, notes, and local databases, along with shell history, network settings, and the list of running processes.
The attacker can also run any shell command, run arbitrary Python, pull whole folders, and slow the malware down to stay quiet. Several command names are in Spanish, and the code carries small bugs, which the researchers read as hand-written rather than AI-generated.
For control, the malware hides in plain sight. It reads its orders from a dataset on Mapbox, a normal mapping service, using it as a dead drop. It resolves that address over DNS-over-HTTPS and uses a domain-fronting trick, so the traffic looks like ordinary Mapbox API calls. Larger uploads go to a separate server at 91.132.163.78.
How far has it spread
YesWeHack and Sekoia found at least seven fake PoC repos, each tied to a high-profile flaw:
- FortiWeb path traversal (CVE-2025-64446)
- React2Shell (CVE-2025-55182)
- MongoBleed (CVE-2025-14847)
- PAN-OS auth bypass (CVE-2026-0257)
- Ivanti Sentry command injection (CVE-2026-10520)
- Check Point VPN auth bypass (CVE-2026-50751)
- Joomla SP Page Builder RCE (CVE-2026-48908)
The skytext package alone was downloaded about 2,400 times, mostly on Linux. Downloads do not prove anyone was infected, but they spiked right after major CVEs went public, which fits the lure.
An earlier run of the same campaign, going back to late 2025, used two other packages, slogsec and logcrypt.cryptography, with near-identical code. Sekoia assesses with high confidence that one actor is behind both, based on reused control markers.
It says the operator rotated through GitHub, PyPI, and Mapbox accounts, several built from leaked or stolen logins. No known group has been named.
Security researchers make a rich target. They run untrusted code by design, often with high privileges, and their machines hold client credentials, private reports, and details of live engagements. Compromise one, and you can reach far past a single laptop.
The MUT-1244 campaign showed the payoff, using fake PoC repositories to steal SSH keys and cloud credentials from red teamers and researchers.
This is not a new idea, only a new wrapper. North Korea’s Lazarus group has courted researchers for years, posing as fellow bug hunters and shipping malicious Visual Studio projects in 2021, then burning a zero-day on them in 2023, with fresh waves since.
On the commodity-crime side, Trend Micro found a fake PoC for a Windows LDAP flaw (CVE-2024-49113) that stole researcher data in early 2025, and a separate campaign pushed fake CVE PoCs carrying a trojan called WebRAT in late 2025, mostly hitting students and junior testers.
What ChocoPoC adds is the hiding spot. The malware lives in a dependency, so the PoC you actually read stays clean. As the researchers put it, the malware itself is old news, but “what is changing is the delivery mechanism.”
What to do now
- Treat any PoC as hostile until proven otherwise, and steer clear of code from brand-new or unknown accounts.
- Read the full dependency chain, not just the PoC file. Watch for freshly published packages, unfamiliar maintainers, and accounts with hidden history.
- Test only in a throwaway VM, but remember isolation alone will not trip this one. The real fix is not installing the packages at all.
- Check your systems for frint, skytext, slogsec, and logcrypt.cryptography, plus the file hashes in the report. If you ran any of them, rotate credentials and rebuild the host.
The bigger risk is downstream. These lures target the researchers who supply detections and PoCs to frameworks like Nuclei and MDUT. Sekoia flags the danger of a double supply chain hit: poison one researcher, and the bad code can ride into a framework thousands of others trust.
