ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized PoC Exploits

ChocoPoC Malware Emerges

A new remote access trojan, known as ChocoPoC, has been discovered targeting cybersecurity researchers. The malware is concealed within trojanized proof-of-concept (PoC) exploit repositories available on GitHub. These PoCs claim to demonstrate vulnerabilities but actually deliver the ChocoPoC trojan, which enables attackers to execute commands and conduct data theft.

Mechanism of the Attack

ChocoPoC operates by embedding itself not directly in the exploit code but as a dependency from the Python Package Index (PyPI). When a researcher clones a malicious repository and installs its dependencies, a package named 'frint' is fetched, which subsequently installs another package called 'skytext'. This secondary package contains the malicious component that compromises the target system.

Targeting Researchers

The campaign is particularly insidious because it exploits the common practice among researchers who quickly download and test PoCs when a new vulnerability is disclosed. This urgency is manipulated to spread the trojan, allowing it to bypass initial code reviews. Researchers at YesWeHack and Sekoia have detailed these findings and urge caution when using community-contributed PoCs.

Implications for the Security Community

The presence of ChocoPoC emphasizes the vulnerability of the security research community to such attacks. It underscores the need for caution and rigorous validation of PoCs, especially those sourced from unofficial repositories. The ongoing activity of the malware also poses a continued threat, and researchers are advised to verify code before execution and be wary of unfamiliar dependencies.