ChocoPoC malware is delivered via trojanized Python packages embedded as dependencies in weaponized PoC exploit repositories on GitHub. The initial malicious package 'frint' installs a secondary package 'skytext' containing a compiled Python extension that decrypts and executes code to download the final ChocoPoC RAT payload from a Mapbox dataset. ChocoPoC can execute arbitrary shell and Python commands, steal browser passwords, cookies, autofill data, browsing history, shell history, network configuration, and enumerate running processes. The malware also abuses Mapbox datasets for data exfiltration. At least seven PoC repositories targeting vulnerabilities in FortiWeb, React2Shell, MongoBleed, PAN-OS, Ivanti Sentry, Check Point VPN, and Joomla SP Page Builder have been identified distributing this malware. The campaign uses compromised GitHub and PyPI accounts to publish malicious packages, with download activity surging after vulnerability disclosures. This delivery method allows the exploit code to remain intact while malicious behavior is assigned to seemingly benign packages, increasing the risk to security researchers and penetration testers who test PoCs without isolation.

ChocoPoC enables attackers to execute arbitrary commands and Python code on infected systems, potentially leading to full system compromise. It can steal sensitive data including browser credentials, cookies, autofill data, browsing history, shell history, and network configuration, which can facilitate further attacks or data breaches. The malware also exfiltrates data using abused Mapbox datasets and an HTTP server for larger uploads. The infection vector targets security researchers and penetration testers by trojanizing PoC exploit repositories, increasing the risk of infection in environments where untrusted code is executed without proper isolation.

No official patch is applicable as this is a malware campaign leveraging social engineering and compromised accounts rather than a software vulnerability. Users, especially security researchers and penetration testers, should avoid blindly trusting GitHub repositories and should execute unverified code only in isolated, controlled environments such as sandboxes or virtual machines. Monitoring for the presence of the malicious Python packages 'frint' and 'skytext' and restricting installation of untrusted PyPI packages can help mitigate risk. Since the campaign uses compromised accounts to publish malicious packages, maintaining strong account security and monitoring for suspicious activity on developer accounts is also recommended.