New ChocoPoC RAT Targets Vulnerability Researchers via Fake PoC Exploit Repos

What Happened

A newly identified malware campaign, dubbed ChocoPoC, is targeting security researchers by disguising a remote access trojan (RAT) inside fake proof-of-concept (PoC) exploit repositories. According to the finding, these repositories masquerade as CVE exploit code but instead pull in malicious packages — reportedly named 'frint' and 'skytext' — that harvest credentials from unsuspecting researchers who clone or run the code. The command-and-control infrastructure behind the campaign was reportedly still active as of July 1, suggesting the operation is ongoing rather than a one-off incident that has already been cleaned up.

Why Researchers Are Prime Targets

Security researchers, penetration testers, and red teamers routinely download and execute PoC code from GitHub and other repositories as part of their daily workflow — often with elevated privileges, access to client environments, or credentials tied to sensitive infrastructure. This makes them an unusually high-value target: a single compromised researcher could hand attackers a foothold into corporate networks, vulnerability disclosure pipelines, or even unreleased exploit research. Fake PoC repositories exploit a very specific trust dynamic — the assumption that code shared in the security community, especially tied to a real CVE, is safe to inspect and run.

The Bigger Pattern in Open Source

This campaign fits into a broader and increasingly common abuse pattern within open-source ecosystems: attackers weaponizing the discovery and trust mechanisms that make platforms like GitHub and package registries (npm, PyPI, and similar) useful in the first place. Naming packages with innocuous-sounding names, backdooring dependencies, and impersonating legitimate research or tooling repositories are all part of the same playbook seen in prior software-supply-chain attacks. What sets ChocoPoC apart is its narrow, deliberate targeting of the vulnerability research community itself — a group that is typically security-conscious but also under pressure to move fast when new CVEs drop.

Why It Matters

For the open-source and security research community, this incident is a reminder that trust signals like GitHub stars, believable README files, or association with a real CVE number are not proof of legitimacy. It also raises questions about how platforms vet and takedown malicious repositories, especially when infrastructure remains live well after initial discovery. Organizations that rely on external researchers or threat intel feeds should treat unsolicited PoC code with the same scrutiny as any other untrusted binary — sandboxing execution, reviewing dependencies, and verifying maintainers before running anything tied to a fresh vulnerability disclosure.

What to Watch

Expect continued scrutiny of package names like 'frint' and 'skytext,' potential takedown notices from GitHub, and likely follow-up analysis identifying additional fake repos or infrastructure tied to the same threat actor.