ChocoPoC Campaign Abuses GitHub PoC Repositories to Steal Browser Credentials

A coordinated supply-chain campaign has been weaponizing GitHub proof-of-concept (PoC) repositories to compromise vulnerability researchers and penetration testers, delivering a stealthy Python Remote Access Trojan (RAT) dubbed “ChocoPoC.”

The lure is simple and effective: newly disclosed high-severity CVEs create urgency for fast PoC and scanner module development.

Adversaries create seemingly legitimate PoC repositories that include malicious entries in requirements.txt (notably packages named frint and skytext) so that when researchers run pip install to set up an exploit environment, a compiled native Python extension is loaded.

That binary (gradient.so / gradient.pyd) contains obfuscated code that dynamically resolves Python and OS APIs, implements anti-analysis checks (PEB walking, debugger and hardware breakpoint detection, export hashing), and decrypts embedded payloads only when executed in a specifically gated runtime (for example, when a PoC file name hash matches EXPLOIT_POC.py).

This environment keying allows the malware to remain dormant in sandboxes and evade many automated detections.

Discovered in a joint investigation by YesWeHack and Sekoia TDR, the attack chain abuses transitive Python dependencies published on PyPI and leverages Mapbox datasets as a covert command-and-control (C2) channel to exfiltrate browser credentials, files, and system intelligence from developer machines.

Once activated, the native extension drops a trojanised _distutils_hack package and malicious .pth files into site-packages, ensuring persistence by auto-executing on every Python interpreter startup.

ChocoPoC Campaign Abuses GitHub

A downloader named choco.py then boots a dead-drop retrieval mechanism: it uses DNS-over-HTTPS (DoH) to resolve api.mapbox[.]com to an attacker-controlled IP, sends HTTPS requests with the legitimate Mapbox host in the SNI/Host header, fetches a Base64-encoded payload stored in a Mapbox dataset feature, decodes and exec()s it.

The final stage is a fully functional RAT that polls the Mapbox-hosted C2 for commands or falls back to a dedicated IP for bulk exfiltration.

ChocoPoC’s capabilities are extensive: automated extraction of stored credentials, cookies, autofill entries and history from Chrome, Edge, Brave and Firefox; targeted file discovery and compression (.txt, .md, .db variants); shell history harvesting; system reconnaissance; arbitrary command execution and dynamic Python code execution via exec().

Commands and variable names show Spanish-language artifacts (hola, dormir), and minor coding errors indicate an actor iterating on a bespoke tool rather than relying on polished commercial malware.

The campaign is broad and persistent. At least seven malicious PoC repositories tied to high-profile CVEs (FortiWeb, React2Shell, Joomla SP Page Builder, Ivanti Sentry, PAN-OS, CheckPoint VPN and others) have been identified; PyPI download metrics for skytext and frint show thousands of pulls timed around vulnerability disclosures.

Investigators link multiple GitHub and PyPI accounts often ephemeral or created from leaked credentials to the same operational patterns: reused Mapbox feature IDs, identical hashing gates, and similar persistence techniques, pointing to a single actor reusing an “opsec” kit across waves in late 2025 and 2026.

Mitigations are straightforward but require discipline: never pip install unreviewed PoC requirements on a production or user-profiled machine; perform dependency installs inside fully isolated, disposable environments (ephemeral VMs or containers).

Prevent credential access and persist only for the test; audit native wheels (.so/.pyd) in dependencies with static and dynamic analysis tools; monitor PyPI and GitHub for sudden new packages tied to PoCs; and block suspicious Mapbox API keys or unexpected Mapbox dataset access at network egress where practicable.

IOCs

Malicious PyPi Packages

Malicious Binaries / Native Python Extensions

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.