ChocoPoc malware delivered via trojanized exploits on GitHub

ChocoPoc is a Python-based remote access trojan (RAT) that was discovered being delivered via trojanized proof-of-concept (PoC) exploits hosted on GitHub. The malware was embedded in what appeared to be legitimate exploit code, likely targeting developers and security researchers who download PoC code from the platform.\n\nThe trojanized exploits served as the delivery mechanism, allowing the attacker to distribute the RAT to users who cloned or downloaded the repositories. Once executed, ChocoPoc can execute arbitrary commands on the infected system and exfiltrate sensitive data.\n\nThis attack demonstrates a supply chain risk targeting the developer community through GitHub repositories, where PoC code is commonly shared and reused. The use of seemingly legitimate exploit code as a delivery vector increases the likelihood of successful infection among technical users.