New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos

Attackers are hiding a data-stealing trojan inside fake exploit code aimed at the people who hunt bugs for a living. The malware, called ChocoPoC, travels in Python proof-of-concept (PoC) repositories on GitHub that claim to exploit hot new CVEs. Run one, and it quietly lifts your saved passwords, browser cookies, and files, then hands the attacker a shell on your machine. YesWeHack and

The article reports that attackers are distributing a Python-based remote access trojan called ChocoPoC through fake GitHub PoC exploit repositories claiming to target recent CVEs, specifically aimed at vulnerability and security researchers.[1][2][3] Once executed, the malware steals browser passwords, cookies, autofill data, shell history, text and database files, and allows arbitrary command and Python code execution, using Mapbox datasets and a separate HTTP server for data exfiltration.[1][2][3] From a CyberSE.AI perspective, this illustrates malicious use of code repositories and tooling that security teams (and AI-assisted research workflows) rely on, underscoring the need to treat third-party PoCs and dependencies as part of the AI/software supply chain and to run untrusted code only in isolated, hardened environments. Organizations should implement continuous red teaming of their research and automation environments, adopt SBOM-driven controls for dependencies, and establish CISO-level policies that govern the safe use of public PoCs and code in any security or AI-assisted analysis pipeline.