# Researchers Under Attack: ChocoPoC RAT Weaponizes Fake Exploit Code on GitHub


Attackers have launched a sophisticated campaign targeting the very people responsible for finding vulnerabilities. Security researchers hunting the latest exploits are being served a Trojan horse—literally—in the form of proof-of-concept code repositories that promise to demonstrate newly discovered CVEs. The malware, dubbed ChocoPoC, quietly harvests credentials, browser data, and sensitive files before granting attackers remote access to victims' machines.


The discovery, documented by security researchers at YesWeHack, reveals a troubling inversion of the vulnerability research ecosystem. Instead of rushing to patch holes, attackers are weaponizing the tools researchers use to validate those patches, creating a supply-chain attack that exploits trust itself.


## The Threat: Trojan-Laden PoC Repositories


ChocoPoC operates through a deceptively simple vector: fake GitHub repositories claiming to host proof-of-concept exploits for recent, high-impact CVEs. Security researchers—particularly those working in vulnerability assessment, penetration testing, or bug bounty programs—frequently search GitHub for PoC code to understand newly disclosed vulnerabilities.


How the attack works:


  • Attackers create GitHub repositories with names designed to appear legitimate (e.g., "CVE-2024-XXXXX-exploit" or similar naming conventions)
  • The repositories include README files describing the vulnerability and promising working exploit code
  • When a researcher clones the repo and runs the Python script, ChocoPoC executes in the background
  • The malware silently exfiltrates saved passwords, browser cookies, session tokens, SSH keys, and sensitive files from the victim's system
  • The attacker gains persistent remote shell access, enabling further lateral movement and exploitation

    • The sophistication lies not in the malware's technical complexity, but in its targeting strategy. By focusing on security professionals who actively engage with exploit code, attackers gain access to machines that often contain:

  • Credentials for testing environments and corporate systems
  • Documentation of internal vulnerability programs
  • Private cryptographic keys
  • Access tokens for cloud infrastructure
  • Organizational security intelligence

    • ## Background and Context: Targeting Researchers


    Vulnerability researchers and security professionals represent a high-value target class. Unlike typical end-users, researchers:


  • Handle exploit code regularly and may lower their guard when examining PoC implementations
  • Have credentials stored locally for lab environments, client testing, and administrative access
  • Often access sensitive systems as part of their professional duties
  • May operate with elevated privileges to facilitate vulnerability testing
  • Frequently maintain archives of sensitive security documentation

    • Why now? The explosion of public vulnerability disclosures, coupled with the democratization of exploit development through platforms like GitHub, has created a perfect hunting ground. Researchers need rapid access to PoC code for validation, patching, and threat assessment—creating time pressure that can override caution.


    The YesWeHack discovery comes amid a broader trend of supply-chain attacks targeting developers and security professionals. Previous campaigns have compromised popular open-source libraries, stolen credentials from development teams, and weaponized trusted development tools. ChocoPoC represents the logical evolution: attacks positioned directly in the workflow of those whose job is to prevent attacks.


    ## Technical Details: How ChocoPoC Operates


    ChocoPoC is a Python-based trojan designed with stealth and persistence in mind. Analysis reveals several key technical characteristics:


    | Component | Function | Impact |

    |-----------|----------|--------|

    | Credential Harvesting | Extracts passwords from browsers (Chrome, Firefox, Edge), saved SSH keys, API tokens | Complete account compromise |

    | Browser Data Exfiltration | Steals cookies, session tokens, cached credentials from major browsers | Authentication bypass across web services |

    | File Staging | Identifies and copies sensitive documents (RSA keys, config files, source code) | Access to production systems and intellectual property |

    | Reverse Shell Installation | Establishes persistent command & control connection | Attacker gains full interactive access |

    | Anti-Detection Obfuscation | Uses common Python libraries to evade signature-based detection | Bypasses basic endpoint protection |


    The malware typically triggers when the Python script is executed—often after a researcher has cloned the repository and reviewed the code. By that point, trust has already been established. The trojan may also:


  • Disable or suppress antivirus warnings
  • Create scheduled tasks to ensure persistence across reboots
  • Beacon to attacker infrastructure to download additional payloads
  • Enumerate network resources and connected systems for lateral movement

    • ## Implications for the Security Community


    The ChocoPoC campaign represents a fundamental threat to the vulnerability research ecosystem. Key implications include:


    Trust Erosion in Public Repositories: Researchers now face a dilemma—download PoC code quickly for validation but risk infection, or spend time vetting code and slow down response efforts. Neither option is ideal.


    Credential Compromise at Scale: If attackers successfully compromise multiple researchers within the same organization or across related firms, the damage multiplies. A single researcher's credentials might grant access to internal testing labs, customer environments, and strategic security initiatives.


    Intelligence Gathering: Stolen documentation, vulnerability research notes, and internal assessments provide attackers with a roadmap of known but unpatched vulnerabilities in target organizations.


    Targeting of Specific Verticals: Security firms, government agencies, and Fortune 500 companies likely employ many researchers. Compromising even a handful grants disproportionate access to high-value targets.


    Undermining of Responsible Disclosure: As researchers become targets, the incentive to participate in bug bounty programs or responsible disclosure initiatives may diminish, slowing the pace at which vulnerabilities are reported and patched.


    ## Recommendations for Researchers and Organizations


    ### For Individual Researchers


  • Isolate PoC Testing: Run proof-of-concept code in isolated virtual machines with no access to production credentials or sensitive data
  • Code Review Before Execution: Examine Python scripts for suspicious imports, network calls, or file operations before running them
  • Use Separate Credentials: Maintain distinct credentials for lab environments versus production systems; never store production credentials on machines used for exploit testing
  • Disable Auto-Run Features: Configure your shell and development environment to prevent automatic code execution
  • Monitor Network Activity: Use a firewall or network monitoring tool to detect unexpected outbound connections from PoC testing environments

    • ### For Security Organizations


  • Implement Zero-Trust Access: Require multi-factor authentication and conditional access policies for systems containing sensitive data, even for trusted employees
  • Credential Rotation: Implement automated credential rotation for high-value accounts, especially those accessible to multiple researchers
  • Endpoint Detection & Response (EDR): Deploy EDR solutions capable of detecting living-off-the-land attacks and unauthorized credential access
  • Repository Verification: Establish internal policies requiring code review and reputation verification before integrating external PoC repositories
  • Sandboxed Testing Infrastructure: Operate air-gapped lab environments where researchers test exploits, isolating them from production networks

    • ### For GitHub and Repository Hosts


  • Verify Repository Owners: Implement stronger identity verification for accounts creating security-adjacent repositories
  • Abuse Reporting: Enhance mechanisms for reporting suspicious repositories claiming to exploit recent CVEs
  • Security Warnings: Display warnings when cloning repositories that match malware signatures or exhibit suspicious behavioral patterns

    • ## Looking Forward


    The ChocoPoC campaign is unlikely to be the last time attackers target researchers. As vulnerability disclosure becomes more transparent and exploit code more readily available, the security research community becomes an increasingly attractive target. The balance between rapid access to security tools and defensive caution will define how effectively the industry responds.


    ---


    ## HackWire Analysis


    The brilliance of the ChocoPoC attack lies not in its technical sophistication but in its social engineering—it exploits the legitimate workflow of security professionals at precisely the moment they're most time-pressured to act. Researchers operating under deadline to understand emerging threats are exactly the population least likely to spend 30 minutes analyzing a GitHub script's behavioral intent.


    What's particularly concerning is the *targeting specificity*. Unlike mass-market malware that casts wide nets, ChocoPoC hunters aren't after casual GitHub users—they're hunting security talent specifically. A compromised vulnerability researcher isn't just a single victim; they're a beachhead into organizations that likely store sensitive security documentation, testing credentials, and strategic threat intelligence. One successful infection could grant attackers a years-long vantage point from inside the security operations of major enterprises or government agencies.


    The discovery also highlights a critical gap in the vulnerability disclosure ecosystem: there's currently no reliable way for researchers to verify the legitimacy of PoC code before execution. Community reputation helps (a repository from a known researcher is lower-risk), but new or unfamiliar accounts can still look credible. GitHub's repository verification mechanisms remain weak; an attacker willing to invest a few weeks building a reputation account can appear established and trustworthy.


    For defenders, the immediate lesson is uncomfortable: isolation is now mandatory. Any machine that executes untrusted code—even code written in high-level, "safe" languages like Python—must be treated as compromised. That means separate credentials, network segmentation, and a presumption that persistence attacks will attempt to exfiltrate data. For researchers in regulated industries (healthcare, finance, defense), a single compromise could trigger incident response obligations and regulatory scrutiny.


    The broader pattern here mirrors other supply-chain attacks we've tracked: APT actors are moving upstream, closer to the source of security decisions. They're targeting the people who decide what gets patched, when, and how. If you can compromise the researchers validating a patch, you can influence remediation timelines across dozens of downstream organizations.


    Organizations need to shift mindset: stop thinking of your security researchers as trusted internal resources with safe behavior profiles. Treat them as high-value attack targets—because they are. The ChocoPoC campaign is likely to be replicated, repackaged, and refined.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)