Back Feeds.4Sysops

Trojanized GitHub exploits deliver ChocoPoC malware via malicious Python dependencies

Feeds.4Sysops •IT News • July 2, 2026

Threat actors are targeting security researchers and penetration testers by distributing weaponized proof-of-concept exploits on GitHub. Unlike traditional attacks that embed malware directly into exploit files, this campaign utilizes malicious Python packages hosted on the Python Package Index. When a user clones a repository and installs the listed dependencies, a chain of trojanized packages eventually downloads the ChocoPoC remote access trojan. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized GitHub Exploits A coordinated supply chain attack has been identified, targeting vulnerability researchers and penetration testers through malicious proof-of-concept (PoC) repositories on GitHub. The malware, named ChocoPoC, is a Python-based remote access trojan (RAT) that stealthily exfiltrates sensitive data. Attackers exploit the urgency surrounding newly disclosed high-severity CVEs to lure victims into downloading compromised PoCs. At least seven fake repositories have been identified, linked to vulnerabilities such as CVE-2026-48908 and CVE-2025-64446. The attack vector involves malicious Python packages, specifically 'frint' and 'skytext', which are installed as dependencies when researchers clone the repositories. Once activated, ChocoPoC can steal browser credentials, execute commands, and maintain persistence on infected systems. The campaign has been active since late 2025, with significant downloads of the malicious packages observed. Security professionals are urged to exercise caution when handling PoCs from untrusted sources. 10 sources 74

Extracted Entities

Trojanized GitHub exploits deliver ChocoPoC malware via malicious Python dependencies

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (2)