# ChocoPoC: Python RAT Distributed via Trojanized PoC Exploits Targeting Security Researchers

> A supply-chain campaign dubbed ChocoPoC (aka ChocoRAT) trojanizes at least seven GitHub proof-of-concept exploit repositories and companion PyPI packages ('frint', 'skytext', with earlier variants 'slogsec' and 'logcrypt.cryptography') to deploy a Python-based remote access trojan against security researchers, penetration testers, and vulnerability analysts who clone and run the PoCs. The RAT executes arbitrary shell/Python commands, steals browser credentials and cookies, harvests shell history and local files, and exfiltrates data via abused Mapbox dataset infrastructure and a dedicated HTTP server.

- **Published:** 2026-07-01T00:00:00Z
- **Last reviewed:** 2026-07-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1125
- **ID:** TL-2026-1125
- **Severity:** HIGH
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 30 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2025-64446, CVE-2025-55182, CVE-2025-14847, CVE-2026-0257, CVE-2026-10520, CVE-2026-50751, CVE-2026-48908, CVE-2025-66478, CVE-2026-10523

## Description

ChocoPoC (aka ChocoRAT) is a Python remote access trojan distributed through a supply-chain campaign that weaponizes the security research community's own workflow: cloning and running public proof-of-concept exploit code. Sekoia, working with YesWeHack, identified at least seven GitHub repositories hosting trojanized PoCs for recently disclosed, high-severity vulnerabilities — FortiWeb (CVE-2025-64446), React2Shell (CVE-2025-55182), MongoBleed (CVE-2025-14847), PAN-OS GlobalProtect (CVE-2026-0257), Ivanti Sentry (CVE-2026-10520), Check Point VPN (CVE-2026-50751), and Joomla SP Page Builder (CVE-2026-48908) — each shipped with a tampered requirements.txt that pulls in the malicious PyPI package 'frint', which in turn depends on 'skytext'.

When a victim runs `pip install` to stand up the exploit environment, skytext installs a small compiled native Python extension (gradient.so on Linux, gradient.pyd on Windows, loaded via the PyInit_gradient entry point) that executes automatically and performs anti-analysis checks — PEB walking, hardware breakpoint detection, remote debugger testing, and export hashing — before decrypting five embedded, zlib-compressed Python payloads. The malware is environmentally gated: it only proceeds once it detects a file resembling the real exploit (exploit.py, EXPLOIT_POC.py, exploit_poc.py) on disk, ensuring it only detonates for genuine PoC users rather than sandboxes. On success it achieves persistence by dropping a trojanized _distutils_hack shim and malicious .pth files into the Python site-packages directory, then timestomps them to blend in with legitimate files. The .pth hook re-triggers on every subsequent Python interpreter start, silently importing a stage-2 downloader named choco.py.

choco.py implements a 'dead-drop' C2 model built on legitimate cloud infrastructure: it uses DNS-over-HTTPS resolvers (dns.alidns.com, cloudflare-dns.com) to resolve api.mapbox.com to an attacker-controlled IP while sending the legitimate Mapbox hostname in the SNI/Host header (domain fronting), then retrieves a Base64-encoded payload stored inside a Mapbox dataset feature, decodes it, and executes it in memory — the final ChocoPoC RAT never touches disk as a discrete binary. The RAT can execute arbitrary shell commands and Python code, upload individual files or entire directories, and specifically searches victim machines for text files, markdown notes, and local database files, plus shell history, network configuration, and running-process listings. It harvests saved passwords, cookies, autofill data, and browsing history from Chrome, Brave, Edge, and Firefox. Small exfiltrated data (status updates, harvested secrets) is written back to a second Mapbox dataset acting as a covert channel; bulk file uploads are instead sent to a dedicated external HTTP server at 91.132.163.78.

Before frint/skytext, the same operators ran an earlier iteration of the campaign using PyPI packages 'slogsec' and 'logcrypt.cryptography', which shared near-identical source code and delivered the same ChocoPoC payload — indicating a persistent, iterating operation rather than a one-off incident. Sekoia pivoted on the GitHub accounts publishing the trojanized repositories (observed under the handle lincemorado97) and found several raw committer email addresses (including leechuung@mail.com and faberhung@mail.com); credentials for two of these emails were found in public leak databases, and a third login 'highly likely originates from an infostealer compromise,' leading Sekoia to assess with high confidence that the operators primarily rely on compromised GitHub/PyPI accounts rather than accounts they registered themselves. Source-code artifacts including Spanish-language strings and function/file naming (e.g., pozos.py, and Spanish words such as 'hola' and 'dormir' used as variable/command names) are the only attribution lead currently available; no threat group has been named or has claimed the campaign. Downloads of the malicious packages spike consistently after major CVE disclosures — e.g., frint/skytext saw a spike on 2026-05-05, matching the addition of the unrelated Linux kernel 'Copy Fail' vulnerability (CVE-2026-31431) to CISA's KEV catalog — indicating the operators actively track high-profile disclosures to time-lure researchers into cloning fresh 'PoC' repositories. skytext alone was downloaded roughly 2,400 times, predominantly on Linux hosts. No CVSS score is assigned to the ChocoPoC campaign itself (it is a malware/supply-chain campaign, not a vulnerability), though it leverages seven separately-scored, in-the-wild-exploited CVEs as delivery lures.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1199 Trusted Relationship
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1129 Shared Modules
- T1574 Hijack Execution Flow
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1622 Debugger Evasion
- T1497 Virtualization/Sandbox Evasion
- T1070 Indicator Removal
- T1620 Reflective Code Loading
- T1057 Process Discovery
- T1082 System Information Discovery
- T1016 System Network Configuration Discovery
- T1083 File and Directory Discovery
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1119 Automated Collection
- T1102 Web Service
- T1071 Application Layer Protocol
- T1132 Data Encoding
- T1090 Proxy
- T1567 Exfiltration Over Web Service
- T1041 Exfiltration Over C2 Channel

## Sources

- [New ChocoPoC malware targets researchers via trojanized PoC exploits](https://www.bleepingcomputer.com/news/security/new-chocopoc-malware-targets-researchers-via-trojanized-poc-exploits/)
- [Don't eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits](https://www.sekoia.com/blog/dont-eat-the-chocopocs-how-vulnerability-researchers-were-repeatedly-targeted-by-trojanised-exploits)
- [Don't eat the ChocoPoCs! Vulnerability researchers were targeted by trojanised exploits](https://www.yeswehack.com/news/chocopocs-vulnerability-researchers-trojanised-exploits)
- [New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos](https://thehackernews.com/2026/07/new-chocopoc-rat-targets-vulnerability.html)
- [Hackers Use Mapbox Dead-Drop C2 and Python RAT to Target Vulnerability Researchers](https://cybersecuritynews.com/hackers-use-mapbox-dead-drop-c2/)
- [Hackers Use Mapbox Dead-Drop C2 and Python RAT to Target Vulnerability Researchers (mirror)](https://www.cryptika.com/hackers-use-mapbox-dead-drop-c2-and-python-rat-to-target-vulnerability-researchers/)
- [CVE-2025-64446 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-64446)
- [CVE-2025-55182 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-55182)
- [CVE-2025-14847 Detail - NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-14847)
- [CVE-2026-0257 PAN-OS: GlobalProtect Authentication Bypass Vulnerabilities](https://security.paloaltonetworks.com/CVE-2026-0257)
- [Security Advisory Ivanti Sentry (CVE-2026-10520, CVE-2026-10523)](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Sentry-CVE-2026-10520-CVE-2026-10523?language=en_US)
- [Patch Critical Check Point VPN Vulnerability (CVE-2026-50751)](https://blog.checkpoint.com/security/check-point-releases-important-hotfix-for-vulnerabilities-in-deprecated-ikev1-vpn-protocol/)
- [June 24 Advisory: SP Page Builder for Joomla Unauthenticated Arbitrary File Upload and RCE CVE-2026-48908](https://censys.com/advisory/cve-2026-48908/)
- [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [CVE-2026-10520 - GitHub Advisory Database (GHSA-v2vc-rgvq-3pwf)](https://github.com/advisories/GHSA-v2vc-rgvq-3pwf)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1125