New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos

The Deceptive Delivery Mechanism

The ChocoPoC campaign distinguishes itself not by the novelty of its malware, which is described as 'old news,' but by its sophisticated delivery mechanism. The attackers exploit the time-sensitive nature of vulnerability research, where researchers often quickly adopt community-shared Proof-of-Concept (PoC) exploits for new CVEs. The malware is not directly embedded in the visible PoC code, which appears clean upon a cursory review. Instead, it is hidden within a Python package, such as 'frint' or 'skytext,' that the legitimate-looking PoC pulls in as a dependency during installation via pip install.

This dependency then loads a compiled file (e.g., gradient.so on Linux, gradient.pyd on Windows) that remains dormant until it detects the actual PoC running, specifically looking for files like EXPLOIT_POC.py. This delayed activation is a clever evasion tactic, allowing the malware to bypass detection in isolated sandbox environments where only the malicious package might be detonated without the full PoC context. Once activated, it unpacks its payload and downloads the ChocoPoC remote access trojan, establishing a persistent foothold.

Targeting High-Value Researchers

Vulnerability researchers represent a high-value target for attackers. Their machines typically operate with elevated privileges and contain a trove of sensitive information, including client credentials, private reports, and details of ongoing security engagements. Compromising such an individual can provide attackers with a gateway to numerous other systems and organizations. ChocoPoC, once active, is designed to exfiltrate a wide array of data, including saved passwords, browser cookies, autofill data, and history from popular browsers like Chrome, Brave, Edge, and Firefox. It also targets text files, notes, local databases, shell history, network settings, and lists of running processes.

For command and control, the malware employs sophisticated techniques to blend in with normal network traffic. It reads orders from a dataset hosted on Mapbox, a legitimate mapping service, using it as a dead drop. This communication is further obscured through DNS-over-HTTPS and domain-fronting, making the traffic appear as routine Mapbox API calls. Larger data uploads are directed to a separate server. YesWeHack and Sekoia identified at least seven fake PoC repositories linked to high-profile flaws, with the skytext package alone downloaded approximately 2,400 times, predominantly on Linux, indicating a significant potential reach within the research community.

A Recurring Threat with Evolving Tactics

The targeting of security researchers through fake PoCs is not a new phenomenon, but ChocoPoC represents an evolution in the delivery mechanism. Previous campaigns, such as MUT-1244, have successfully used similar lures to steal SSH keys and cloud credentials from red teamers. Notorious state-sponsored groups like North Korea's Lazarus group have also consistently targeted researchers, employing tactics ranging from malicious Visual Studio projects to zero-day exploits. On the commodity crime front, campaigns like the one distributing WebRAT have also leveraged fake CVE PoCs to compromise students and junior testers.

What ChocoPoC adds to this landscape is the refined method of hiding the malicious payload within a dependency, ensuring the primary PoC code remains untainted. This makes detection more challenging for researchers who might only review the top-level PoC script. The campaign's use of rotated GitHub, PyPI, and Mapbox accounts, some built from leaked or stolen logins, further underscores the attackers' operational security and persistence. The ultimate risk extends beyond individual compromise, posing a 'double supply chain hit' where a compromised researcher could inadvertently introduce malicious code into widely trusted security frameworks like Nuclei and MDUT, amplifying the potential for widespread harm.