Threat reportMalwareTL-2026-1062
ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python Packages to Backdoor Security Researchers
ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python (TL-2026-1062), also tracked as ChocoPoC, is a high-severity malware campaign, first published 2026-07-02. It has no confirmed attribution, affects PyPI frint (malicious package), references 7 CVEs (CVE-2025-64446, CVE-2025-55182, CVE-2025-14847), maps to 34 MITRE ATT&CK techniques (T1005, T1016, T1027.004), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 34MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-1062
- Threat ID
- TL-2026-1062
- Also known as
- ChocoPoC
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- information-technology, cybersecurity-research
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 24
Malware and tooling in ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python
Malware and tooling: ChocoPoC
How ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python works
YesWeHack and Sekoia jointly disclosed (2026-07-01) a supply-chain campaign distributing a Python-based RAT dubbed ChocoPoC via trojanized PyPI dependency packages ('frint' and 'skytext') bundled with fake GitHub PoC exploit repositories for seven high-severity 2025-2026 CVEs. The RAT activates only when the genuine exploit file is present, steals browser credentials, files, shell history, and system data, and exfiltrates via Mapbox dataset dead-drops using DNS-over-HTTPS domain fronting, with a fallback HTTP upload server for larger files.
ChocoPoC is a full-featured Python remote access trojan distributed through a supply-chain attack targeting security researchers, red teamers, and vulnerability hunters. The operator published at least seven fake GitHub repositories purporting to contain proof-of-concept exploit code for recent, high-profile CVEs (FortiWeb, React2Shell, MongoBleed, PAN-OS GlobalProtect, Ivanti Sentry, Check Point VPN, and Joomla SP Page Builder), each requiring installation of a trojanized PyPI dependency named 'frint'. During setup, 'frint' pulls a secondary malicious package, 'skytext', which contains a compiled native Python extension ('gradient.so' on Linux, 'gradient.pyd' on Windows). The extension only decrypts and executes its embedded downloader logic once it detects the real PoC exploit file (e.g., 'EXPLOIT_POC.py') is present and being loaded — a sandbox/analysis-evasion trigger condition that prevents the payload from firing in automated malware analysis environments that lack the full repository context. Once triggered, the downloader retrieves the ChocoPoC payload from a Mapbox dataset used as a dead-drop, with command-and-control and exfiltration traffic disguised as legitimate Mapbox API calls via DNS-over-HTTPS domain fronting; bulk file uploads are instead routed to a dedicated HTTP server at 91.132.163.78. ChocoPoC provides full RAT functionality: arbitrary shell command execution, arbitrary Python code execution, file/directory upload, and theft of saved passwords, cookies, autofill data, and browsing history from Chrome, Brave, Edge, and Firefox, plus text/markdown/database files, shell history, network configuration, and running process enumeration. The 'skytext' package alone recorded roughly 2,400 downloads, predominantly on Linux hosts, with download spikes correlating to major CVE disclosure dates — indicating researchers and defenders were actively pulling the packages while triaging the underlying vulnerabilities. Earlier-generation packages in the same operator's toolkit, 'slogsec' and 'logcrypt.cryptography', share control-flow markers with the current campaign, indicating a single actor has run this operation since at least late 2025. Sekoia found that credentials tied to two email addresses used to register PyPI/GitHub publishing accounts had appeared in public leak databases, with at least one 'highly likely' originating from a prior infostealer compromise — suggesting the operator built out publishing infrastructure using stolen credentials rather than purpose-registered accounts, complicating attribution. As of the 2026-07-01 joint disclosure, YesWeHack and Sekoia confirmed the malware and its C2/exfiltration infrastructure remained live and operational. The campaign is notable for directly weaponizing the vulnerability-research and red-team community's own workflow — installing dependencies to test a PoC — turning routine exploit triage into an initial-access vector, and echoes prior operator-vs-researcher campaigns (MUT-1244 targeting red-teamer SSH/cloud credentials via fake PoC/benchmark packages, and Lazarus Group's 2021 trojanized Visual Studio projects and 2023 zero-day use against security researchers).
MITRE ATT&CK techniques used in TL-2026-1062
Collection
T1005 Data from Local System; T1119 Automated Collection; T1560 Archive Collected Data
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027.004 Compile After Delivery; T1036.005 Match Legitimate Resource Name or Location; T1127 Trusted Developer Utilities Proxy Execution; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol; T1567 Exfiltration Over Web Service
Execution
T1059.004 Unix Shell; T1059.006 Python; T1204.002 Malicious File; T1610 Deploy Container
Command and Control
T1071.001 Web Protocols; T1071.004 DNS; T1102.002 Bidirectional Communication; T1105 Ingress Tool Transfer; T1132.001 Standard Encoding; T1568.002 Domain Generation Algorithms; T1573 Encrypted Channel
initial-access
T1195.002 Compromise Software Supply Chain
Initial Access
T1195.002 Compromise Software Supply Chain; T1199 Trusted Relationship
Credential Access
T1539 Steal Web Session Cookie; T1555.003 Credentials from Web Browsers
Persistence
T1554 Compromise Host Software Binary
Resource Development
T1583.006 Web Services; T1585.001 Social Media Accounts; T1586 Compromise Accounts; T1587.001 Malware
Affected products and versions in ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python
- PyPI — frint (malicious package)
Vulnerable versions: all published versions - PyPI — skytext (malicious package)
Vulnerable versions: all published versions - PyPI — slogsec (malicious package, earlier campaign)
Vulnerable versions: all published versions - PyPI — logcrypt.cryptography (malicious package, earlier campaign)
Vulnerable versions: all published versions - Fortinet — FortiWeb
Vulnerable versions: 8.0.0-8.0.1; 7.6.0-7.6.4; 7.4.0-7.4.9; 7.2.0-7.2.11; 7.0.0-7.0.11
Fixed in: 8.0.2+; 7.6.5+; 7.4.10+; 7.2.12+; 7.0.12+ - Vercel/Meta (React ecosystem) — React Server Components / Next.js (React2Shell)
Vulnerable versions: versions predating Dec 2025 patch
Fixed in: patched builds released Dec 2025 - MongoDB — MongoDB Server (MongoBleed)
Vulnerable versions: prior to 8.2.3, 8.0.17, 7.0.28, 6.0.27, 5.0.32, 4.4.30
Fixed in: 8.2.3; 8.0.17; 7.0.28; 6.0.27; 5.0.32; 4.4.30 - Palo Alto Networks — PAN-OS GlobalProtect Portal/Gateway, Prisma Access
Vulnerable versions: deployments with Authentication Override Cookies enabled and vulnerable certificate configuration
Fixed in: vendor patch per PAN-OS advisory - Ivanti — Ivanti Sentry
Vulnerable versions: prior to R10.5.2, R10.6.2, R10.7.1
Fixed in: R10.5.2; R10.6.2; R10.7.1 - Check Point — Remote Access VPN / Mobile Access (IKEv1)
Vulnerable versions: deployments using deprecated IKEv1 key exchange
Fixed in: hotfix per sk185033
Remediation for ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python
Immediate actions
- Treat every third-party PoC exploit repository as potentially hostile until source and dependency chain are independently verified
- Audit and remove the packages 'frint', 'skytext', 'slogsec', and 'logcrypt.cryptography' from any environment that has run pip install against a downloaded PoC
- Search hosts for 'gradient.so' (Linux) and 'gradient.pyd' (Windows) file artifacts
- Block outbound connections to 91.132.163.78
- Rotate all browser-stored credentials, cookies, and session tokens on any host that executed a suspect PoC package
- Rebuild/reimage any confirmed-compromised host rather than attempting in-place remediation
Workarounds
- Disable automatic pip dependency resolution when testing unfamiliar exploit repositories; manually inspect each declared dependency before installation
Longer-term hardening
- Execute all third-party PoC/exploit code exclusively inside isolated, network-restricted, disposable VMs or containers, never on primary research or production workstations
- Implement dependency-chain auditing (SBOM review, pip install --dry-run inspection, PyPI package age/maintainer reputation checks) before installing any newly published package tied to exploit code
- Monitor egress DNS-over-HTTPS traffic and Mapbox API usage for anomalous patterns inconsistent with legitimate application use
- Deploy EDR with behavioral detection tuned to catch native-extension-triggered decrypt-and-execute chains in Python packages
CVEs associated with ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python
CVE-2025-64446, CVE-2025-55182, CVE-2025-14847, CVE-2026-0257, CVE-2026-10520, CVE-2026-50751, CVE-2026-48908
Weaknesses (CWE) in ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python
Timeline of ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python
- CVE-2025-64446 (FortiWeb path traversal/auth bypass) disclosed and confirmed exploited in the wild, later used as a lure theme for a fake ChocoPoC PoC repository.
- CVE-2025-55182 (React2Shell, CVSS 10.0 pre-auth RCE in React Server Components) publicly disclosed, later used as a lure theme for a fake ChocoPoC PoC repository.
- CVE-2025-14847 (MongoBleed) added to CISA KEV catalog confirming active exploitation; subsequently used as a lure theme for a fake ChocoPoC PoC repository.
- CVE-2026-50751 (Check Point VPN IKEv1 authentication bypass) confirmed under active exploitation, including by a Qilin ransomware affiliate; later used as a ChocoPoC lure theme.
- Public proof-of-concept released for CVE-2026-10520 (Ivanti Sentry pre-auth OS command injection, CVSS 10.0); internet-exposed gateways backdoored within a day, and the CVE was later used as a ChocoPoC lure theme.
- JoomShaper released SP Page Builder 6.6.2 patching CVE-2026-48908 (unauthenticated file upload to RCE); the flaw was later used as a ChocoPoC lure theme.
- The Hacker News and BleepingComputer publish coverage of the ChocoPoC campaign, summarizing the Sekoia/YesWeHack research.
- YesWeHack and Sekoia jointly publish findings on the ChocoPoC campaign, confirming the malware and its Mapbox/HTTP C2 infrastructure (including upload server 91.132.163.78) remained live and operational at time of publication.
Sources cited for ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python
- New ChocoPoC RAT Targets Vulnerability Researchers via Malicious PoC Packages
- New ChocoPoC malware targets researchers via trojanized PoC exploits
- CVE-2025-64446 Detail - NVD
- Unauthenticated Authentication Bypass in Fortinet FortiWeb (CVE-2025-64446) Exploited in the Wild
- Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components
- Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)
- CVE-2025-14847: All You Need to Know About MongoBleed
- MongoBleed CVE-2025-14847 exploited in the wild
- Threat Actors Exploit GlobalProtect Vulnerability CVE-2026-0257
- CVE-2026-10520: Ivanti Sentry Command Injection
- Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520)
- Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751)
- sk185033 - CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange
- June 24 Advisory: SP Page Builder for Joomla Unauthenticated Arbitrary File Upload and RCE [CVE-2026-48908]
- CVE-2026-48908-PoC: Unauthenticated RCE PoC for CVE-2026-48908 — SP Page Builder for Joomla
Detection coverage for TL-2026-1062
As of 2026-07-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1062 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.