Malware Targets InfoSec: Fake PoC Delivers Cobalt Strike

Cyble researchers discovered GitHub repositories advertised as POCs for CVE-2022-26809 and CVE-2022-24500 that actually host ConfuserEx-protected .NET malware. The samples display fake exploit output, execute hidden PowerShell via cmd.exe to fetch a Cobalt Strike Beacon, and include network and file IOCs; the report provides technical details, MITRE ATT&CK mappings, and recommendations for the infosec community to avoid untrusted POCs.