Cybersecurity researchers have uncovered a new malware campaign that specifically targets vulnerability researchers and penetration testers. The malware, named ChocoPoC, is being spread through fake proof-of-concept (PoC) exploit repositories hosted on GitHub. These repositories appear to contain working exploits for newly disclosed security vulnerabilities, making them look trustworthy to professionals who regularly test the latest CVEs.
Unlike many previous malware campaigns, ChocoPoC does not place the malicious code directly inside the exploit itself. Instead, the attackers hide it inside Python dependencies that are automatically installed when users run the project’s installation process. As a result, researchers may unknowingly infect their own systems while believing they are simply preparing the PoC for testing.
The campaign was jointly discovered by researchers from Sekoia and YesWeHack, who found multiple fake repositories pretending to exploit recently disclosed vulnerabilities. These repositories closely resemble legitimate research projects, making it difficult for users to distinguish between genuine and malicious code. The attackers take advantage of the fact that researchers often rush to validate newly published vulnerabilities.
According to the researchers, the infection begins when a victim installs the required Python packages listed in the project’s dependency file. A malicious package is downloaded first, which then silently installs another hidden package containing a compiled module. This module decrypts and launches the ChocoPoC remote access trojan without drawing attention, allowing the attack to remain hidden during normal testing.
Once active, ChocoPoC gives attackers remote access to the compromised machine. It can execute system commands, run Python code, collect browser passwords, steal cookies, capture browsing history, gather shell history, and retrieve network configuration details. These capabilities allow attackers to gain valuable information that can be used for additional attacks or unauthorized access.
Researchers also found that the malware uses legitimate online services in an unusual way to support its operations. It retrieves parts of its payload from Mapbox-hosted datasets and can upload stolen information through remote infrastructure controlled by the attackers. By using trusted services, the campaign becomes harder to detect because its network activity may appear legitimate at first glance.
Security experts believe this campaign highlights a growing trend where attackers abuse the trust placed in open-source repositories and publicly shared exploit code. Instead of attacking organizations directly, they focus on the security professionals who analyze vulnerabilities every day. This approach increases the chances of compromising high-value research environments and sensitive security data.
To reduce the risk, experts recommend treating public PoC repositories with caution, even when they appear genuine. Researchers should carefully review project dependencies, avoid blindly installing unknown Python packages, and always test untrusted exploit code inside isolated virtual machines or sandbox environments. Following these practices can significantly reduce the chances of malware infections during vulnerability research.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
