ChocoPoC RAT Hides in Fake PoCs

Attackers deploy ChocoPoC malware inside fake Python proof-of-concept repositories on GitHub targeting vulnerability researchers. The trojan hides within malicious dependencies like skytext and frint rather than the main exploit file, stealing passwords from browsers including Chrome and Firefox while exfiltrating data via Mapbox datasets or a server at 91.132.163.78.