ChocoPoC Campaign Abuses GitHub PoC Repositories to Steal Browser Credentials

Gbhackers •Mayura Kathir • July 2, 2026

A coordinated supply-chain campaign has been weaponizing GitHub proof-of-concept (PoC) repositories to compromise vulnerability researchers and penetration testers, delivering a stealthy Python Remote Access Trojan (RAT) dubbed “ChocoPoC.” The lure is simple and effective: newly disclosed high-severity CVEs create urgency for fast PoC and scanner module development. Adversaries create seemingly legitimate PoC repositories that include […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized GitHub Exploits A coordinated supply chain attack has been identified, targeting vulnerability researchers and penetration testers through malicious proof-of-concept (PoC) repositories on GitHub. The malware, named ChocoPoC, is a Python-based remote access trojan (RAT) that stealthily exfiltrates sensitive data. Attackers exploit the urgency surrounding newly disclosed high-severity CVEs to lure victims into downloading compromised PoCs. At least seven fake repositories have been identified, linked to vulnerabilities such as CVE-2026-48908 and CVE-2025-64446. The attack vector involves malicious Python packages, specifically 'frint' and 'skytext', which are installed as dependencies when researchers clone the repositories. Once activated, ChocoPoC can steal browser credentials, execute commands, and maintain persistence on infected systems. The campaign has been active since late 2025, with significant downloads of the malicious packages observed. Security professionals are urged to exercise caution when handling PoCs from untrusted sources. 8 sources 74

Extracted Entities

ChocoPoC Campaign Abuses GitHub PoC Repositories to Steal Browser Credentials

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (1)