Threat actors are actively targeting vulnerability researchers and penetration testers with a stealthy Python Remote Access Trojan (RAT) dubbed “ChocoPoC.”
Exploiting the cybersecurity industry’s rush to test newly disclosed vulnerabilities, hackers are distributing fake Proof-of-Concept (PoC) exploits on GitHub.
When researchers download and run these malicious repositories, they inadvertently compromise their own development environments.
This sophisticated campaign relies on trojanized Python dependencies to bypass standard security checks and deliver a payload capable of exfiltrating sensitive data, harvesting browser credentials, and executing arbitrary commands.
A joint investigation by YesWeHack and Sekoia TDR reveals that this supply chain attack has been successfully compromising pentesting tools since late 2025.
ChocoPoC Targets Python Dependencies
The attack begins when a researcher attempts to test a critical vulnerability using a community-shared PoC from GitHub.
Recent lures have capitalized on high-profile disclosures such as the Joomla RCE (CVE-2026-48908), the FortiWeb path traversal (CVE-2025-64446), and React2Shell (CVE-2025-55182).
The malicious repositories include a standard requirements file that tricks the victim into installing seemingly harmless Python packages.
Recent campaigns have heavily relied on packages named “frint” and “skytext” to initiate the compromise.
By hiding the malicious behavior inside a transitive dependency, the main PoC script appears entirely clean during manual review.
The “skytext” package masquerades as a tool for terminal colors, but its compiled binaries harbor obfuscated malware.
Python’s package-loading mechanism naturally prioritizes these compiled native extensions over standard source files, allowing the malware to shadow legitimate imports and seamlessly bootstrap itself into the environment.
ChocoPoC is designed to be highly evasive and persistent. It uses environmental key gating to ensure it executes only when the specific lure PoC script is running on the machine.
The payload hashes the basenames of all loaded Python modules. It proceeds only if it detects the exact runtime signature of the exploit script.
If detonated in a standard isolated sandbox environment, the malware remains completely dormant and bypasses automated security scans.
According to Sekoia research, the malware’s use of Mapbox datasets acts as a highly effective dead-drop system. The downloader opens an HTTPS connection using a custom adapter that forces Server Name Indication to api.mapbox.com.
This domain-fronting technique ensures the handshake appears to be legitimate Mapbox traffic, allowing the communications to blend seamlessly into normal API usage.
Once active, the RAT continuously polls this channel for commands, allowing attackers to harvest web browser credentials, scan for database files, and execute arbitrary shell commands.
Malicious PyPI Packages
| Package Name | Version | SHA-256 Hash (Wheel) |
|---|---|---|
skytext | 1.1.0 | 93739477cd379adef95126b22758c0e644282d2028dd297328ce856fa111dd06 |
frint | 0.1.2 | 17997e9e0256d0f5d5d21a4852c37f16b338e4bb9c2bec09bdfd822b24aa76b4 |
slogsec | * | 5abd45d6f4a1705dca55d882f017d4768888dce9ad99cea40b3da35c23de5cae |
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
){kind=link}