# ChocoPoC RAT Campaign Uses Malicious PoC-Exploit Python Packages to Backdoor Security Researchers

> YesWeHack and Sekoia jointly disclosed (2026-07-01) a supply-chain campaign distributing a Python-based RAT dubbed ChocoPoC via trojanized PyPI dependency packages ('frint' and 'skytext') bundled with fake GitHub PoC exploit repositories for seven high-severity 2025-2026 CVEs. The RAT activates only when the genuine exploit file is present, steals browser credentials, files, shell history, and system data, and exfiltrates via Mapbox dataset dead-drops using DNS-over-HTTPS domain fronting, with a fallback HTTP upload server for larger files.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1062
- **ID:** TL-2026-1062
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-64446, CVE-2025-55182, CVE-2025-14847, CVE-2026-0257, CVE-2026-10520, CVE-2026-50751, CVE-2026-48908

## Description

ChocoPoC is a full-featured Python remote access trojan distributed through a supply-chain attack targeting security researchers, red teamers, and vulnerability hunters. The operator published at least seven fake GitHub repositories purporting to contain proof-of-concept exploit code for recent, high-profile CVEs (FortiWeb, React2Shell, MongoBleed, PAN-OS GlobalProtect, Ivanti Sentry, Check Point VPN, and Joomla SP Page Builder), each requiring installation of a trojanized PyPI dependency named 'frint'. During setup, 'frint' pulls a secondary malicious package, 'skytext', which contains a compiled native Python extension ('gradient.so' on Linux, 'gradient.pyd' on Windows). The extension only decrypts and executes its embedded downloader logic once it detects the real PoC exploit file (e.g., 'EXPLOIT_POC.py') is present and being loaded — a sandbox/analysis-evasion trigger condition that prevents the payload from firing in automated malware analysis environments that lack the full repository context. Once triggered, the downloader retrieves the ChocoPoC payload from a Mapbox dataset used as a dead-drop, with command-and-control and exfiltration traffic disguised as legitimate Mapbox API calls via DNS-over-HTTPS domain fronting; bulk file uploads are instead routed to a dedicated HTTP server at 91.132.163.78. ChocoPoC provides full RAT functionality: arbitrary shell command execution, arbitrary Python code execution, file/directory upload, and theft of saved passwords, cookies, autofill data, and browsing history from Chrome, Brave, Edge, and Firefox, plus text/markdown/database files, shell history, network configuration, and running process enumeration. The 'skytext' package alone recorded roughly 2,400 downloads, predominantly on Linux hosts, with download spikes correlating to major CVE disclosure dates — indicating researchers and defenders were actively pulling the packages while triaging the underlying vulnerabilities. Earlier-generation packages in the same operator's toolkit, 'slogsec' and 'logcrypt.cryptography', share control-flow markers with the current campaign, indicating a single actor has run this operation since at least late 2025. Sekoia found that credentials tied to two email addresses used to register PyPI/GitHub publishing accounts had appeared in public leak databases, with at least one 'highly likely' originating from a prior infostealer compromise — suggesting the operator built out publishing infrastructure using stolen credentials rather than purpose-registered accounts, complicating attribution. As of the 2026-07-01 joint disclosure, YesWeHack and Sekoia confirmed the malware and its C2/exfiltration infrastructure remained live and operational. The campaign is notable for directly weaponizing the vulnerability-research and red-team community's own workflow — installing dependencies to test a PoC — turning routine exploit triage into an initial-access vector, and echoes prior operator-vs-researcher campaigns (MUT-1244 targeting red-teamer SSH/cloud credentials via fake PoC/benchmark packages, and Lazarus Group's 2021 trojanized Visual Studio projects and 2023 zero-day use against security researchers).

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1585.001 Social Media Accounts
- T1587.001 Malware
- T1583.006 Web Services
- T1195.002 Compromise Software Supply Chain
- T1195.002 Compromise Software Supply Chain
- T1199 Trusted Relationship
- T1204.002 Malicious File
- T1059.006 Python
- T1059.004 Unix Shell
- T1610 Deploy Container
- T1554 Compromise Host Software Binary
- T1140 Deobfuscate/Decode Files or Information
- T1027.004 Compile After Delivery
- T1497.001 System Checks
- T1036.005 Match Legitimate Resource Name or Location
- T1127 Trusted Developer Utilities Proxy Execution
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1016 System Network Configuration Discovery
- T1057 Process Discovery
- T1083 File and Directory Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1119 Automated Collection
- T1071.001 Web Protocols
- T1071.004 DNS
- T1573 Encrypted Channel
- T1105 Ingress Tool Transfer
- T1568.002 Domain Generation Algorithms
- T1132.001 Standard Encoding
- T1102.002 Bidirectional Communication
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel
- T1048 Exfiltration Over Alternative Protocol

## Sources

- [New ChocoPoC RAT Targets Vulnerability Researchers via Malicious PoC Packages](https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html)
- [New ChocoPoC malware targets researchers via trojanized PoC exploits](https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/)
- [CVE-2025-64446 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-64446)
- [Unauthenticated Authentication Bypass in Fortinet FortiWeb (CVE-2025-64446) Exploited in the Wild](https://blog.qualys.com/vulnerabilities-threat-research/2025/11/14/unauthenticated-authentication-bypass-in-fortinet-fortiweb-cve-2025-64446-exploited-in-the-wild)
- [Defending against the CVE-2025-55182 (React2Shell) vulnerability in React Server Components](https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/)
- [Multiple Threat Actors Exploit React2Shell (CVE-2025-55182)](https://cloud.google.com/blog/topics/threat-intelligence/threat-actors-exploit-react2shell-cve-2025-55182)
- [CVE-2025-14847: All You Need to Know About MongoBleed](https://www.akamai.com/blog/security-research/cve-2025-14847-all-you-need-to-know-about-mongobleed)
- [MongoBleed CVE-2025-14847 exploited in the wild](https://www.tenable.com/blog/cve-2025-14847-mongobleed-mongodb-memory-leak-vulnerability-exploited-in-the-wild)
- [Threat Actors Exploit GlobalProtect Vulnerability CVE-2026-0257](https://www.esentire.com/security-advisories/threat-actors-exploit-globalprotect-vulnerability-cve-2026-0257)
- [CVE-2026-10520: Ivanti Sentry Command Injection](https://horizon3.ai/attack-research/vulnerabilities/cve-2026-10520/)
- [Critical Ivanti Sentry flaw allows root-level remote code execution (CVE-2026-10520)](https://www.helpnetsecurity.com/2026/06/10/ivanti-sentry-cve-2026-10520-cve-2026-10523/)
- [Qilin ransomware affiliate exploited Check Point VPN zero-day (CVE-2026-50751)](https://www.helpnetsecurity.com/2026/06/08/check-point-cve-2026-50751-qilin-ransomware/)
- [sk185033 - CVE-2026-50751 - User Authentication bypass on VPN Remote Access and Mobile Access in deprecated IKEv1 key exchange](https://support.checkpoint.com/results/sk/sk185033)
- [June 24 Advisory: SP Page Builder for Joomla Unauthenticated Arbitrary File Upload and RCE CVE-2026-48908](https://censys.com/advisory/cve-2026-48908/)
- [CVE-2026-48908-PoC: Unauthenticated RCE PoC for CVE-2026-48908 — SP Page Builder for Joomla](https://github.com/papageo75/CVE-2026-48908-PoC)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1062