Threat reportSupply ChainTL-2026-1125
ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits Targeting Security Researchers
ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits (TL-2026-1125), also tracked as ChocoRAT, is a high-severity supply-chain compromise, first published 2026-07-01. It has no confirmed attribution, affects Fortinet FortiWeb, references 9 CVEs (CVE-2025-64446, CVE-2025-55182, CVE-2025-14847), maps to 31 MITRE ATT&CK techniques (T1005, T1016, T1027), and is covered by 9 detection rules and 30 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 9Referenced vulnerabilities
- Techniques
- 31MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 30Indicators of compromise
Key facts for TL-2026-1125
- Threat ID
- TL-2026-1125
- Also known as
- ChocoRAT
- Severity
- HIGH
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, cybersecurity, professional-services
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 30
Malware and tooling in ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits
Malware and tooling: ChocoPoC, choco
How ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits works
A supply-chain campaign dubbed ChocoPoC (aka ChocoRAT) trojanizes at least seven GitHub proof-of-concept exploit repositories and companion PyPI packages ('frint', 'skytext', with earlier variants 'slogsec' and 'logcrypt.cryptography') to deploy a Python-based remote access trojan against security researchers, penetration testers, and vulnerability analysts who clone and run the PoCs. The RAT executes arbitrary shell/Python commands, steals browser credentials and cookies, harvests shell history and local files, and exfiltrates data via abused Mapbox dataset infrastructure and a dedicated HTTP server.
ChocoPoC (aka ChocoRAT) is a Python remote access trojan distributed through a supply-chain campaign that weaponizes the security research community's own workflow: cloning and running public proof-of-concept exploit code. Sekoia, working with YesWeHack, identified at least seven GitHub repositories hosting trojanized PoCs for recently disclosed, high-severity vulnerabilities — FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS GlobalProtect (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908) — each shipped with a tampered requirements.txt that pulls in the malicious PyPI package 'frint', which in turn depends on 'skytext'.
When a victim runs `pip install` to stand up the exploit environment, skytext installs a small compiled native Python extension (gradient.so on Linux, gradient.pyd on Windows, loaded via the PyInit_gradient entry point) that executes automatically and performs anti-analysis checks — PEB walking, hardware breakpoint detection, remote debugger testing, and export hashing — before decrypting five embedded, zlib-compressed Python payloads. The malware is environmentally gated: it only proceeds once it detects a file resembling the real exploit (exploit.py, EXPLOIT_POC.py, exploit_poc.py) on disk, ensuring it only detonates for genuine PoC users rather than sandboxes. On success it achieves persistence by dropping a trojanized _distutils_hack shim and malicious .pth files into the Python site-packages directory, then timestomps them to blend in with legitimate files. The .pth hook re-triggers on every subsequent Python interpreter start, silently importing a stage-2 downloader named choco.py.
choco.py implements a 'dead-drop' C2 model built on legitimate cloud infrastructure: it uses DNS-over-HTTPS resolvers (dns.alidns.com, cloudflare-dns.com) to resolve api.mapbox.com to an attacker-controlled IP while sending the legitimate Mapbox hostname in the SNI/Host header (domain fronting), then retrieves a Base64-encoded payload stored inside a Mapbox dataset feature, decodes it, and executes it in memory — the final ChocoPoC RAT never touches disk as a discrete binary. The RAT can execute arbitrary shell commands and Python code, upload individual files or entire directories, and specifically searches victim machines for text files, markdown notes, and local database files, plus shell history, network configuration, and running-process listings. It harvests saved passwords, cookies, autofill data, and browsing history from Chrome, Brave, Edge, and Firefox. Small exfiltrated data (status updates, harvested secrets) is written back to a second Mapbox dataset acting as a covert channel; bulk file uploads are instead sent to a dedicated external HTTP server at 91.132.163.78.
Before frint/skytext, the same operators ran an earlier iteration of the campaign using PyPI packages 'slogsec' and 'logcrypt.cryptography', which shared near-identical source code and delivered the same ChocoPoC payload — indicating a persistent, iterating operation rather than a one-off incident. Sekoia pivoted on the GitHub accounts publishing the trojanized repositories (observed under the handle lincemorado97) and found several raw committer email addresses (including leechuung@mail.com and faberhung@mail.com); credentials for two of these emails were found in public leak databases, and a third login 'highly likely originates from an infostealer compromise,' leading Sekoia to assess with high confidence that the operators primarily rely on compromised GitHub/PyPI accounts rather than accounts they registered themselves. Source-code artifacts including Spanish-language strings and function/file naming (e.g., pozos.py, and Spanish words such as 'hola' and 'dormir' used as variable/command names) are the only attribution lead currently available; no threat group has been named or has claimed the campaign. Downloads of the malicious packages spike consistently after major CVE disclosures — e.g., frint/skytext saw a spike on 2026-05-05, matching the addition of the unrelated Linux kernel 'Copy Fail' vulnerability (CVE-2026-31431) to CISA's KEV catalog — indicating the operators actively track high-profile disclosures to time-lure researchers into cloning fresh 'PoC' repositories. skytext alone was downloaded roughly 2,400 times, predominantly on Linux hosts. No CVSS score is assigned to the ChocoPoC campaign itself (it is a malware/supply-chain campaign, not a vulnerability), though it leverages seven separately-scored, in-the-wild-exploited CVEs as delivery lures.
MITRE ATT&CK techniques used in TL-2026-1125
Collection
T1005 Data from Local System; T1119 Automated Collection
Discovery
T1016 System Network Configuration Discovery; T1057 Process Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery
Defense Evasion
T1027 Obfuscated Files or Information; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1620 Reflective Code Loading; T1622 Debugger Evasion
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059 Command and Scripting Interpreter; T1129 Shared Modules; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1090 Proxy; T1102 Web Service; T1132 Data Encoding
Initial Access
T1195 Supply Chain Compromise; T1199 Trusted Relationship
Credential Access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
stealth
Resource Development
T1583 Acquire Infrastructure; T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Affected products and versions in ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits
- Fortinet — FortiWeb
Vulnerable versions: 7.0; 7.2; 7.4; 7.6; 8.0
Fixed in: See Fortinet PSIRT advisory for CVE-2025-64446 - Meta/Vercel (React ecosystem) — React Server Components / Next.js
Vulnerable versions: Versions using vulnerable RSC Flight protocol prior to patch
Fixed in: Patched builds per CVE-2025-55182 / CVE-2025-66478 advisories - MongoDB Inc. — MongoDB Server
Vulnerable versions: Versions vulnerable to zlib-compressed message heap disclosure (CVE-2025-14847)
Fixed in: Patched MongoDB releases per vendor advisory - Palo Alto Networks — PAN-OS (GlobalProtect portal/gateway)
Vulnerable versions: PAN-OS versions with GlobalProtect authentication override cookies enabled and affected certificate configuration
Fixed in: Patched PAN-OS versions per security.paloaltonetworks.com/CVE-2026-0257 - Ivanti — Ivanti Sentry
Vulnerable versions: Versions prior to R10.5.2, R10.6.2, R10.7.1
Fixed in: R10.5.2; R10.6.2; R10.7.1 - Check Point — Remote Access VPN / Mobile Access (IKEv1)
Vulnerable versions: Deployments using deprecated IKEv1 key exchange
Fixed in: Check Point hotfix per CVE-2026-50751 advisory - JoomShaper — SP Page Builder for Joomla
Vulnerable versions: Up to and including 6.6.1
Fixed in: 6.6.2 - PyPI (Python Package Index) — Malicious packages: frint, skytext, slogsec, logcrypt.cryptography
Vulnerable versions: All published versions of these package names are malicious
Fixed in: Not applicable — packages should be removed/blocked, not upgraded
Remediation for ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits
Patches
- Apply Fortinet's fix for CVE-2025-64446 across all FortiWeb 7.0/7.2/7.4/7.6/8.0 branches
- Apply the React Server Components / Next.js patch for CVE-2025-55182 (and companion CVE-2025-66478)
- Apply the MongoDB patch addressing the CVE-2025-14847 (MongoBleed) memory disclosure
- Apply Palo Alto Networks' PAN-OS fix for CVE-2026-0257 GlobalProtect authentication bypass
- Upgrade Ivanti Sentry to R10.5.2, R10.6.2, or R10.7.1 or later to remediate CVE-2026-10520/CVE-2026-10523
- Apply Check Point's hotfix for CVE-2026-50751/CVE-2026-50752 and migrate off deprecated IKEv1
- Upgrade SP Page Builder for Joomla to version 6.6.2 or later to remediate CVE-2026-48908
Immediate actions
- Audit any environment where PoC exploit code for CVE-2025-64446, CVE-2025-55182, CVE-2025-14847, CVE-2026-0257, CVE-2026-10520, CVE-2026-50751, or CVE-2026-48908 was cloned or executed for gradient.so/gradient.pyd, choco.py, or a tampered _distutils_hack/.pth file in site-packages
- Rotate all browser-stored credentials, cookies, and session tokens on any host that ran `pip install` against a PoC repository requirements.txt referencing these CVEs
- Immediately uninstall the frint, skytext, slogsec, and logcrypt.cryptography PyPI packages from all developer and research systems
- Block outbound traffic to 91.132.163.78 and alert on anomalous api.mapbox.com/datasets API calls originating from developer or research workstations
- Hunt for python.exe/python3 child processes spawned at interpreter startup with no corresponding user-initiated script (indicative of the .pth-triggered choco.py loader)
Workarounds
- Disable the deprecated IKEv1 key exchange on Check Point Remote Access VPN and Mobile Access deployments
- Restrict or disable GlobalProtect authentication override cookies on PAN-OS until patched
- Do not run `pip install` against requirements.txt from unverified or unofficial PoC/exploit repositories; manually inspect all declared dependencies first
Longer-term hardening
- Require PoC/exploit code and its declared dependencies to be reviewed and executed only inside isolated, network-restricted, disposable sandboxes/VMs before running against research targets
- Deploy EDR with visibility into Python native-extension loading, .pth file writes to site-packages, and unusual DNS-over-HTTPS usage on researcher/pentester endpoints
- Adopt organizational policy requiring manual dependency review (not just `pip install`) for requirements.txt shipped inside third-party PoC repositories
- Monitor CISA KEV additions and correlate any resulting spikes in related PyPI package downloads with potential trojanized-PoC activity
CVEs associated with ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits
CVE-2025-64446, CVE-2025-55182, CVE-2025-14847, CVE-2026-0257, CVE-2026-10520, CVE-2026-50751, CVE-2026-48908, CVE-2025-66478, CVE-2026-10523
Weaknesses (CWE) in ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits
CWE-22, CWE-288, CWE-502, CWE-125, CWE-347, CWE-78, CWE-287, CWE-284, CWE-506
Timeline of ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits
- Sekoia telemetry indicates the operators behind ChocoPoC-linked infrastructure and TTPs have been active since at least 2023 (exact date not specified in source reporting).
- Earlier iteration of the campaign distributes the PyPI packages 'slogsec' and 'logcrypt.cryptography', sharing near-identical source code and delivering the same ChocoPoC payload as the later frint/skytext generation.
- CVE-2025-64446 (FortiWeb path-traversal/auth-bypass RCE) confirmed under active exploitation; later reused as a trojanized-PoC lure in the ChocoPoC campaign.
- CVE-2025-55182 (React2Shell) publicly disclosed as a CVSS 10.0 unauthenticated RCE in React Server Components; subsequently used as a ChocoPoC PoC lure.
- CISA adds CVE-2025-14847 (MongoBleed) to the Known Exploited Vulnerabilities catalog, confirming active exploitation; later used as a ChocoPoC PoC lure.
- CISA adds the unrelated Linux kernel 'Copy Fail' vulnerability (CVE-2026-31431) to its KEV catalog; the resulting publicity is later linked to a spike in ChocoPoC-related package downloads.
- frint and skytext PyPI packages see a download spike coinciding with the CVE-2026-31431 ('Copy Fail') KEV addition, indicating operators time malicious package pushes to high-profile disclosures.
- CISA adds CVE-2026-0257 (PAN-OS GlobalProtect authentication bypass) to the KEV catalog; later used as a ChocoPoC PoC lure.
- CISA adds CVE-2026-50751 (Check Point VPN IKEv1 authentication bypass) to the KEV catalog; later used as a ChocoPoC PoC lure.
- CISA adds CVE-2026-10520 (Ivanti Sentry OS command injection) to the KEV catalog; later used as a ChocoPoC PoC lure.
- Censys publishes an advisory for CVE-2026-48908 (Joomla SP Page Builder unauthenticated file upload RCE), the most recent CVE later trojanized in the ChocoPoC campaign.
- Sekoia and YesWeHack publicly disclose the ChocoPoC campaign; BleepingComputer, The Hacker News, and other outlets report on seven trojanized PoC repositories and the frint/skytext PyPI packages.
Sources cited for ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits
- New ChocoPoC malware targets researchers via trojanized PoC exploits
- Don't eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits
- Don't eat the ChocoPoCs! Vulnerability researchers were targeted by trojanised exploits
- New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos
- Hackers Use Mapbox Dead-Drop C2 and Python RAT to Target Vulnerability Researchers
- Hackers Use Mapbox Dead-Drop C2 and Python RAT to Target Vulnerability Researchers (mirror)
- CVE-2025-64446 Detail - NVD
- CVE-2025-55182 Detail - NVD
- CVE-2025-14847 Detail - NVD
- CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities
- Security Advisory Ivanti Sentry (CVE-2026-10520, CVE-2026-10523)
- Patch Critical Check Point VPN Vulnerability (CVE-2026-50751)
- June 24 Advisory: SP Page Builder for Joomla Unauthenticated Arbitrary File Upload and RCE [CVE-2026-48908]
- Known Exploited Vulnerabilities Catalog
- CVE-2026-10520 - GitHub Advisory Database (GHSA-v2vc-rgvq-3pwf)
Detection coverage for TL-2026-1125
As of 2026-07-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1125 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.