ChocoPoc malware delivered via trojanized exploits on GitHub
Source Bleeping Computer
Description
ChocoPoC is a Python-based remote access trojan (RAT) distributed via trojanized proof-of-concept (PoC) exploit repositories on GitHub. The malware is delivered through malicious Python packages added as dependencies in these PoCs, which are hosted on the Python Package Index (PyPI). Once installed, the packages execute code that downloads and runs the ChocoPoC RAT, capable of executing arbitrary commands and stealing sensitive data such as browser credentials and network configurations. Multiple PoC repositories for various vulnerabilities have been identified as distributing this malware. The campaign primarily uses compromised accounts to publish malicious packages and PoCs, targeting security researchers and penetration testers who run untrusted code. Users are advised to avoid blindly trusting GitHub repositories and to execute unverified code only in isolated environments.