ChocoPoC RAT Hits 2,400+ Researchers via Dependency-Poisoned GitHub PoCs

For the cybersecurity community, this isn’t just another malware alert—it’s a direct strike against the tools of our trade. ChocoPoC exploits the very trust researchers place in PoC code and open-source dependencies, proving that even seasoned professionals can be compromised by a poorly vetted repository. The use of Mapbox as a covert C2 channel represents a clever abuse of trusted cloud services that could easily bypass standard network monitoring.

A sophisticated malware campaign targeting the cybersecurity research community has been uncovered, leveraging weaponized proof-of-concept (PoC) exploits on GitHub to deliver a newly identified Python-based remote access trojan (RAT) named ChocoPoC. Discovered by researchers at Sekoia, the campaign represents a significant evolution in supply-chain attacks, moving beyond simply embedding malicious code in PoC files to poisoning the very dependency ecosystem that developers and researchers rely on. By injecting malicious PyPI packages into the dependency list of publicly available exploit repositories, the threat actor has created a stealthy infection vector that compromises victims before any exploit code is even manually executed.

“

Sekoia’s discovery will likely prompt GitHub and PyPI to accelerate their malicious package detection capabilities, but the onus remains on the community to treat every piece of untrusted code with extreme suspicion.

The campaign is not the first to target security professionals, but its technical sophistication marks a new level of danger. ChocoPoC distributes itself through at least seven GitHub repositories, each supposedly containing functional exploits for high-profile vulnerabilities including FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908). When a victim clones one of these repositories, the trojanized Python package ‘frint’ is fetched and installed automatically from PyPI. Frint, in turn, pulls a dependency called ‘skytext’ which contains a compiled native Python extension. This extension is designed to decrypt and execute additional code upon PoC execution, launching a downloader that retrieves the final ChocoPoC payload from a dataset hosted on Mapbox—a mapping and location data platform abused here for covert command-and-control and data exfiltration.

The choice of Mapbox is particularly insidious; it allows the malware to blend in with legitimate HTTPS traffic and evade network detection mechanisms that might flag unfamiliar domains. Sekoia reports that the skytext package alone has been downloaded approximately 2,400 times, predominantly on Linux-based systems, with a noticeable spike following the public disclosure of a popular vulnerability used as a lure. Although it remains uncertain how many of these downloads led to full compromise, the number highlights the widespread exposure and the potential impact on security research networks, which often have privileged access to sensitive tools and data. Moreover, the threat actor uses Mapbox datasets for exfiltration of smaller files, while larger uploads are routed through a separate HTTP server, indicating a tiered approach to data theft that maximizes stealth.