Threat reportMalwareTL-2026-1088
ChocoPoC Campaign: Trojanised PoC Exploits and PyPI Packages Deliver Python RAT Using Mapbox Datasets API as Dead-Drop C2
ChocoPoC Campaign (TL-2026-1088), also tracked as ChocoPoC, is a high-severity malware campaign, first published 2026-07-02. It has no confirmed attribution, affects PyPI frint, references 7 CVEs (CVE-2025-64446, CVE-2025-55182, CVE-2025-14847), maps to 39 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 0 detection rules and 43 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 7Referenced vulnerabilities
- Techniques
- 39MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 0SPL · KQL · Sigma
- IOCs
- 43Indicators of compromise
Key facts for TL-2026-1088
- Threat ID
- TL-2026-1088
- Also known as
- ChocoPoC
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- ESPIONAGE
- Target sectors
- information technology, cybersecurity research, government administration
- Target regions
- Global
- Detection rules
- 0
- Indicators of compromise
- 43
Malware and tooling in ChocoPoC Campaign
Malware and tooling: ChocoPoC
How ChocoPoC Campaign works
A supply-chain campaign tracked by Sekoia (with YesWeHack) as 'ChocoPoC' has, since at least November 2025, distributed trojanised CVE proof-of-concept exploits on GitHub bundled with malicious PyPI dependencies (frint, skytext, slogsec, logcrypt.cryptography) that deploy a Python RAT. The RAT retrieves commands from the legitimate Mapbox Datasets API as a dead-drop channel, resolves the endpoint via DNS-over-HTTPS with domain fronting, and harvests browser credentials, files, and system data from vulnerability researchers and pentesters.
ChocoPoC is a long-running supply-chain compromise campaign that specifically targets vulnerability researchers and penetration testers — a population whose security tooling is often deliberately relaxed while testing exploit code. The threat actor publishes fake GitHub repositories purporting to contain working proof-of-concept exploits for high-profile, recently disclosed CVEs (e.g. FortiWeb, React2Shell, MongoBleed, PAN-OS, Ivanti Sentry, Check Point VPN, Joomla SP Page Builder). Each fake repository ships a tampered requirements.txt that pulls in a malicious top-level PyPI package (frint in the 2026 wave, slogsec in the 2025 wave), which in turn installs a secondary dependency (skytext, logcrypt.cryptography) bundling a precompiled, obfuscated native Python extension (gradient.pyd on Windows, gradient.so on Linux).
The native extension is loaded via Python's ExtensionFileLoader the moment the package is imported. It performs anti-analysis checks (PEB walking, debugger/hardware-breakpoint detection, export hashing, CheckRemoteDebuggerPresent) and gates execution behind an environment check: it scans the working directory for a file whose uppercased name hashes to 0xF4835C9C, which corresponds to EXPLOIT_POC.PY. This means the payload only detonates when the victim is actually running the bundled fake exploit — not merely upon package installation — which defeats most automated sandbox and CI scanning.
Once triggered, the extension decrypts five embedded Python payloads using a custom XOR/rotate keystream algorithm seeded with the hardcoded key EXPLOIT_POC.PY, followed by zlib decompression. Persistence is established by dropping a trojanised _distutils_hack package and a distutils-precedence.pth file into the Python site-packages directory, causing the malicious loader to auto-execute on every subsequent Python interpreter startup; files are timestomped afterward to hinder forensic timeline reconstruction. A downloader script, choco.py, then resolves api.mapbox[.]com using DNS-over-HTTPS resolvers (AliDNS, Cloudflare DNS) rather than the OS's configured resolvers, and uses a custom SSL adapter to force the SNI/Host header to the legitimate Mapbox hostname while routing the underlying TCP connection to attacker infrastructure — a form of domain fronting. The malware then queries a specific Mapbox Datasets API feature (dataset cmor0tcxf008i1mmpd7apt903, feature dm370543acmdopk296nahbtua under account frankley) whose stored property field is abused as a dead-drop mailbox for C2 instructions, so command retrieval blends into ordinary-looking HTTPS calls to a trusted mapping SaaS.
The final-stage Python RAT supports a small Spanish-language command set (hola for recon, cmd for shell execution, python for base64-encoded exec() code execution, get for file/directory staging and compression, browserdata for credential harvesting, dormir to adjust beacon sleep interval) and exfiltrates staged/compressed data to a hardcoded upload server at 91.132.163.78:8001. Harvested data includes stored passwords, cookies, autofill entries and browsing history from Chrome, Edge, Brave and Firefox; targeted files (.txt, .md, .db); shell history; and system/network reconnaissance output. File-lock mutexes and hardcoded anti-recursion environment variables (ZEBUWIAKGPHOQAP006, JKHWQVEKRASDF12) prevent multiple concurrent executions.
Sekoia and YesWeHack assess with high confidence that a single threat actor operates the campaign across both the 2025 wave (slogsec / logcrypt.cryptography) and the 2026 wave (frint / skytext), based on a reused Mapbox feature ID, identical anti-recursion environment-variable markers, identical hash-gating logic, and near-identical RAT source code between waves. The actor rotates GitHub accounts (lincemorado97, ogenich, bolubey), PyPI uploader identities, and Mapbox accounts (frankley, mattallahsaed, james09790), several of which were created using apparently compromised email addresses and abandoned once repositories were reported/banned. Spanish-language function and variable names throughout the RAT (dormir, hola, dataset_usuario, obtener_id) point to a Spanish-speaking developer, though no formal group attribution has been made. At time of the joint Sekoia/YesWeHack report (2026-07-01) the malware, PyPI packages, and C2/exfiltration infrastructure remained live.
MITRE ATT&CK techniques used in TL-2026-1088
Collection
T1005 Data from Local System; T1074.001 Local Data Staging; T1560 Archive Collected Data
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1027.002 Software Packing; T1036 Masquerading; T1036.005 Match Legitimate Resource Name or Location; T1070.006 Timestomp; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1048 Exfiltration Over Alternative Protocol
Execution
T1059.004 Unix Shell; T1059.006 Python; T1106 Native API; T1204.002 Malicious File
Command and Control
T1071.001 Web Protocols; T1102.001 Dead Drop Resolver; T1105 Ingress Tool Transfer; T1568.003 DNS Calculation; T1573 Encrypted Channel
command-and-control
Initial Access
T1195 Supply Chain Compromise; T1195.001 Compromise Software Dependencies and Development Tools; T1199 Trusted Relationship
initial-access
T1195.002 Compromise Software Supply Chain
Persistence
T1505 Server Software Component; T1546.015 Component Object Model Hijacking
Credential Access
T1555.003 Credentials from Web Browsers
stealth
Resource Development
T1583.006 Web Services; T1585 Establish Accounts; T1586 Compromise Accounts; T1587.001 Malware
Affected products and versions in ChocoPoC Campaign
- PyPI — frint
Vulnerable versions: 0.1.2
Fixed in: removed from PyPI - PyPI — skytext
Vulnerable versions: 1.1.0
Fixed in: removed from PyPI - PyPI — slogsec
Vulnerable versions: all known versions
Fixed in: removed from PyPI - PyPI — logcrypt.cryptography
Vulnerable versions: all known versions
Fixed in: removed from PyPI - GitHub — Trojanised CVE PoC repositories (lincemorado97, ogenich, bolubey accounts)
Vulnerable versions: all identified repositories
Fixed in: banned/removed by GitHub
Remediation for ChocoPoC Campaign
Immediate actions
- Block outbound connections to exfiltration server 91.132.163.78:8001
- Alert on and investigate any DNS-over-HTTPS queries to dns.alidns.com or cloudflare-dns.com originating from developer/researcher workstations
- Remove/uninstall the malicious PyPI packages frint, skytext, slogsec, and logcrypt.cryptography if present in any Python environment
- Search site-packages directories for distutils-precedence.pth and a trojanised _distutils_hack/__init__.py
- Hunt for gradient.pyd (Windows) or gradient.so (Linux) files, especially loaded from user-writable virtualenv or site-packages paths
- Rotate credentials and browser-stored passwords/cookies on any host that ran a PoC from the identified GitHub repositories
Workarounds
- Manually review requirements.txt of any third-party CVE PoC repository before running pip install
- Static/dynamic-analyze any compiled native wheel (.pyd/.so) bundled inside a PyPI dependency before use
Longer-term hardening
- Require vulnerability researchers/pentesters to execute untrusted PoC code only in fully isolated, disposable environments (ephemeral VMs or containers with no persistent credentials)
- Implement dependency review/allowlisting for PyPI packages pulled by PoC repositories before installation
- Deploy EDR rules for anomalous Python child-process spawning with hidden-window flags
- Monitor egress to api.mapbox.com for anomalous dataset/feature access patterns tied to security research workstations
CVEs associated with ChocoPoC Campaign
CVE-2025-64446, CVE-2025-55182, CVE-2025-14847, CVE-2026-0257, CVE-2026-10520, CVE-2026-48908, CVE-2026-50751
Weaknesses (CWE) in ChocoPoC Campaign
Timeline of ChocoPoC Campaign
- First identified ChocoPoC activity: malicious PyPI packages slogsec and logcrypt.cryptography published alongside a trojanised PoC targeting CVE-2025-64446 (FortiWeb path traversal).
- Trojanised slogsec-based PoC for CVE-2025-64446 published to GitHub.
- Mapbox account 'skytext'-linked infrastructure created for dead-drop C2 use.
- Second trojanised slogsec-based PoC published, targeting CVE-2025-55182 (React2Shell).
- Download spike observed for skytext/frint packages coinciding with a Linux vulnerability being added to the CISA KEV catalog.
- Trojanised slogsec-based PoC published targeting CVE-2025-14847 (MongoBleed).
- Download spike for slogsec coinciding with Langflow RCE disclosure.
- Mapbox account 'frankley' created, later identified as hosting the 2026-wave dead-drop dataset/feature used for C2.
- 2026-wave trojanised PoC (frint/skytext) published targeting CVE-2026-0257 (PAN-OS authentication bypass).
- Trojanised PoC (frint/skytext) published targeting CVE-2026-10520 (Ivanti Sentry OS command injection).
- Trojanised PoC (frint/skytext) published targeting CVE-2026-48908 (Joomla SP Page Builder RCE); campaign detected by YesWeHack/Sekoia around this time.
- Sekoia and YesWeHack jointly publish the 'Don't eat the ChocoPoCs!' report detailing the full campaign, IOCs, and infrastructure; malware and C2/exfiltration infrastructure confirmed still live at publication.
- Widespread security-media coverage of the campaign (Cyber Security News, The Hacker News, BleepingComputer, GBHackers, SC Media, Cyberpress, Cryptika).
Sources cited for ChocoPoC Campaign
- Hackers Use Mapbox as Dead Drop C2 to Deliver Malicious Payload
- Don't eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits
- New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
- ChocoPoC Campaign Abuses GitHub PoC Repositories to Steal Browser Credentials
- New ChocoPoC malware targets researchers via trojanized PoC exploits
- Hackers Hide ChocoPoC Malware in Python Dependencies to Compromise Pentesters
- New ChocoPoC trojan targets security researchers with fake exploit code
- Hackers Use Mapbox Dead-Drop C2 and Python RAT to Target Vulnerability Researchers
Detection coverage for TL-2026-1088
As of 2026-07-02, Threadlinqs Intelligence publishes 0 detection rule(s) for TL-2026-1088 across Splunk SPL, Microsoft KQL and Sigma, covering 43 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.