Loading story…
A malware campaign dubbed ChocoPoC used fake or trojanized GitHub proof-of-concept exploit repositories for newly disclosed CVEs to infect cybersecurity researchers, penetration testers, and bug hunters. Researchers at Sekoia and YesWeHack said the visible exploit code often appeared benign, while the real payload was introduced through malicious PyPI dependencies including frint and skytext. The package chain decrypted and executed code that fetched the final Python-based remote access trojan from a Mapbox dataset, and investigators linked at least seven repositories to the operation. The activity appears to have relied largely on compromised accounts to publish the poisoned packages and repositories, with skytext alone drawing roughly 2,400 downloads, mostly on Linux systems.
Once activated, ChocoPoC provided remote shell and Python execution, stole browser credentials and files, uploaded data, enumerated processes, and collected host details such as network configuration and shell history. The malware was designed to evade casual review and simple sandboxing by delaying activation until the PoC was run, while also using DNS-over-HTTPS to resolve infrastructure and 91.132.163.78 for larger uploads. Investigators said related activity may date back to late 2025 through earlier packages such as slogsec and logcrypt.cryptography, raising concern that compromises of researcher workstations could create downstream supply-chain risk for trusted security tooling and frameworks.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers said activity related to the ChocoPoC campaign appears to date back to late 2025, when earlier packages such as slogsec and logcrypt.cryptography were used. This indicates the operation predates the newly identified frint/skytext package chain.
Sekoia linked multiple waves of malicious repositories and packages through shared infrastructure and coding patterns, assessing that the ChocoPoC operation has been active since at least 2023. This pushes the known start of the campaign significantly earlier than previously documented late-2025 activity.
Sekoia assessed with high confidence that the attackers primarily relied on compromised accounts to publish the malicious PyPI packages and proof-of-concept repositories. This attribution detail explains how the campaign seeded trusted-looking developer resources.
The malicious PyPI package skytext was observed to have roughly 2,400 downloads, mostly on Linux systems. This provided a measurable indicator of the campaign's reach among likely researcher targets.
Researchers linked at least seven fake or malicious PoC exploit repositories to the ChocoPoC operation. The repositories presented benign-looking exploit code while triggering installation of malicious dependencies when run.
Sekoia and YesWeHack identified a campaign that used weaponized GitHub proof-of-concept repositories for newly disclosed CVEs to target cybersecurity researchers and penetration testers. The repositories relied on malicious PyPI dependencies including frint and skytext to deliver the Python-based ChocoPoC remote access trojan.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
8 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourcelinuxsecurity.com
Open sourceyeswehack.com
Open sourcebleepingcomputer.com
Open sourcesekoia.com
Open sourceblog.google
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A new malware family named **Webrat** has been distributed through GitHub repositories, masquerading as proof-of-concept (PoC) exploits for high-profile vulnerabilities. The campaign, uncovered in late 2025, initially targeted gamers and users seeking cheats or cracked software, but later expanded to include inexperienced information security professionals and students. Attackers crafted repositories with detailed, AI-generated descriptions of vulnerabilities, including guides and mitigation steps, to build credibility and lure victims into downloading malicious files. The malware is delivered as a password-protected archive containing an executable that escalates privileges, disables Windows Defender, and downloads the Webrat payload from a hardcoded URL. Once installed, Webrat can steal credentials from Telegram, Discord, Steam, and cryptocurrency wallets, log keystrokes, record screens, access webcams and microphones, and provide remote access to attackers. The campaign leverages vulnerabilities with high CVSSv3 scores, such as those in Internet Explorer, WordPress plugins, Windows services, and Tenda routers, to attract victims searching for exploit code.
Jun 29, 2026
A spear-phishing campaign targeted Japanese organizations with HR-themed lures impersonating company representatives and delivered a multi-stage malware chain built around **PXDropper**, the **PoisonX** kernel driver, and the modular **10FXRAT** remote-access trojan. Victims were directed to Google Cloud Storage-hosted archives containing ZIP, RAR, LNK, or EXE payloads, including polyglot Windows shortcut files that dropped decoy Japanese PDFs and used obfuscated downloaders to fetch second-stage malware such as `RuntimeBroker.exe`. The operators also disguised payloads as legitimate Feishu/Lark and Baidu Netdisk installers and abused DLL sideloading with signed binaries including `dashost.exe` and `unregmp2.exe` to decrypt and launch the malware. Once installed, PoisonX used kernel-level capabilities to terminate security tools and conceal malicious processes and network traffic, while 10FXRAT provided remote shell access, SOCKS5 tunneling, persistence, plugin-based expansion, and tampering with Microsoft Defender. Researchers said the activity continued into May and expanded to Chinese organizations, with the operators shifting from a signed PoisonX driver to **BYOVD** techniques using legitimately signed but vulnerable drivers such as **ASUSTeK `EneIo64.sys`** and Microsoft **`procexp.sys`**. The campaign exposed at least 61 indicators, including 49 SHA-256 hashes and 12 IPv4 command-and-control addresses; notable infrastructure included the Google Cloud Storage bucket `opentokenaiit`, the URL `https://storage.googleapis.com/opentokenaiit/newgram.exe`, and C2 address `101.32.190.202`. Researchers assessed the tradecraft as consistent with a China-nexus operation, with one report noting a possible but unconfirmed link to **Silver Fox**.
Jun 29, 2026
A sophisticated malware campaign has been uncovered in which threat actors use GitHub to distribute a new Remote Access Trojan (RAT) called PyStoreRAT. The attackers reactivated dormant GitHub accounts or created new ones to publish repositories masquerading as legitimate OSINT tools, DeFi bots, and AI chat wrappers. These repositories, often promoted on social media and artificially boosted in popularity, were designed to appeal to IT administrators, cybersecurity professionals, and open-source intelligence researchers. Once the repositories gained trust and visibility, the attackers introduced malicious code through subtle 'maintenance' updates, enabling the silent deployment of PyStoreRAT. PyStoreRAT is a modular, multi-stage malware capable of executing a variety of payloads, including EXE, DLL, PowerShell, MSI, Python, JavaScript, and HTA modules. It profiles victim systems and can deploy additional threats such as the Rhadamanthys information stealer and Python Loader. Many of the fake tools hosted on GitHub were non-functional or provided only minimal placeholder features, serving primarily as a delivery mechanism for the malware. The campaign demonstrates a calculated abuse of GitHub's trust model and highlights the risks of downloading and executing code from seemingly reputable open-source repositories.
Jun 29, 2026