ChocoPoc malware delivered via trojanized exploits on GitHub

Attackers are distributing a Python-based remote access trojan named ChocoPoC through fake proof-of-concept exploit repositories on GitHub. The malware hides in malicious Python packages on PyPI, automatically installed when victims clone a repository. ChocoPoC steals passwords, browser cookies, and files, and gives attackers shell access. The campaign targets cybersecurity researchers.