ChocoPoC Malware Targets Cybersecurity Researchers via Trojanized GitHub Exploits

A coordinated supply-chain campaign dubbed "ChocoPoC" uses malicious GitHub proof-of-concept repositories and dependent Python packages ('frint', 'skytext') to deliver a Python RAT that steals browser credentials, executes commands, and maintains persistence. At least seven fake repositories tied to high-severity CVEs (including CVE-2026-48908 and CVE-2025-64446) have been observed since late 2025 with significant package downloads; security researchers are urged to treat PoCs from untrusted sources with caution.