ChocoPoC — a Python RAT Hidden in Fake GitHub PoC Exploits, with a Mapbox Dead-Drop C2

ChocoPoC is a fully-functional Python RAT disclosed jointly by YesWeHack and Sekoia on 2026-07-01 that hides inside fake proof-of-concept (PoC) exploit repositories on GitHub claiming to exploit hot, freshly-disclosed CVEs. The campaign specifically targets vulnerability researchers and pentesters — the people most likely to clone and run an untrusted PoC. As of the report the malware and its servers were still live; researchers explicitly warned not to run any of the identified PoCs.

The trick is dependency-chaining: the PoC declares a dependency on a Python package named frint, which in turn drags in skytext. skytext ships a small compiled native extension — gradient.so on Linux, gradient.pyd on Windows — that executes the moment the PoC is launched. Activation is gated on the presence of a file named EXPLOIT_POC.py / exploit.py / exploit_poc.py (a filename-hash check, 0xF4835C9C), so the payload stays dormant in a sandbox that lacks the full PoC. The skytext package alone was downloaded ~2,400 times, mostly on Linux, with spikes right after major CVE disclosures.

Once live, ChocoPoC harvests browser credentials, cookies, autofill and history (Chrome, Brave, Edge, Firefox), plus local files, notes, shell history, network settings and process lists. For C2 it uses a Mapbox dataset as a dead drop — reading its orders from api.mapbox[.]com, resolving over DNS-over-HTTPS (dns.alidns[.]com, cloudflare-dns[.]com) with domain fronting so traffic looks like ordinary Mapbox API calls. Bulk exfiltration goes to a separate server at 91.132.163.78:8001. Persistence rides trojanized setuptools distutils hooks (_distutils_hack/override.py, a distutils-precedence.pth file), and the payload is heavily armored (timestomping, PEB walking, export hashing, anti-debug via CheckRemoteDebuggerPresent and hardware breakpoints, environmental gating).

Defender priority: The highest-value, lowest-FP angles are installation of the malicious packages (skytext / frint / slogsec), the compiled payload files (gradient.so / gradient.pyd), the Sekoia-published SHA-256 hashes, egress to 91.132.163.78, and git clone of the known fake-PoC repos. This is a developer-workstation threat: focus coverage on engineering, research and pentest hosts (Linux and Windows), and keep offensive-security tooling off production identities.

Every atomic IOC below (SHA-256 hashes, package names, payload filenames, exfil IP, Mapbox/DoH domains, fake-repo paths) traces to the Sekoia / YesWeHack indicator set. The package/payload names, hashes and the 91.132.163.78 exfil server are durable; api.mapbox.com and cloudflare-dns.com are legitimate services abused as carriers, so those are hunt/scoped indicators, not blanket blocks.

ChocoPoC is cross-platform (Linux and Windows). The CQL below uses the CrowdStrike-normalized process/file/network events, which apply to both the Windows sensor and Falcon for Linux; confirm Linux sensor coverage on engineering/research hosts before relying on it.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A host installed a malicious ChocoPoC package (skytext / frint / slogsec) via pip. Delivery.
2. H2 (high): The compiled payload gradient.so / gradient.pyd was written to disk (into a skytext package dir). Payload drop.
3. H3 (high): A file matching a Sekoia-published ChocoPoC SHA-256 executed or was written. Atomic.
4. H4 (high): A host connected to the exfil server 91.132.163.78 (port 8001). Covers T1041.
5. H5 (high): A host git cloned one of the known fake-PoC repos (lincemorado97 / ogenich / bolubey). Early warning.
6. H6 (medium): A Python interpreter resolved the Mapbox dead-drop / DoH carriers (api.mapbox.com, dns.alidns.com, cloudflare-dns.com). Covers T1071.001 / T1090.004.
7. H7 (medium): A Python interpreter made outbound connections to a public IP shortly after running a PoC. Beacon/exfil generic.
8. H8 (medium): Trojanized setuptools persistence appeared (_distutils_hack/override.py, distutils-precedence.pth). Covers T1546.016 / T1574.006-style startup hook.

Attack chain

All values published by Sekoia / YesWeHack. Package names, payload filenames, SHA-256 hashes and the 91.132.163.78 exfil server are durable indicators. api.mapbox.com, cloudflare-dns.com and dns.alidns.com are legitimate services abused as carriers — treat them as scoped hunt indicators (correlate with a Python interpreter / PoC context), not blanket blocks.

• PyPI / pip inventory: On developer, research and CI hosts, inventory installed packages and flag any presence of skytext, frint, slogsec, or logcrypt.cryptography (pip list / SBOM / artifact-proxy logs). Check internal PyPI mirror download logs for these names.
• Payload file sweep: Search site-packages trees for gradient.so / gradient.pyd and for a distutils-precedence.pth or modified _distutils_hack/override.py that did not come from a clean setuptools install.
• Browser credential access: On hosts that ran a suspect PoC, hunt for a Python process opening Chrome/Edge/Brave Login Data / Network\Cookies or the Firefox logins.json/key4.db — a Python interpreter touching browser secret stores is the stealer tell.
• Environment markers: Check for the anti-recursion env vars ZEBUWIAKGPHOQAP006 and JKHWQVEKRASDF12 in process environments on suspect hosts.
• GitHub / proxy logs: Search web-proxy / git-server logs for clones of the fake-PoC repos (owners lincemorado97, ogenich, bolubey), and rotate any credentials that were present on a host that ran one.

Promotion path: validate the high-CONF/low-FP queries (Q1, Q2, Q4, Q5) against 7–14 days of baseline on developer/research hosts, confirm zero benign hits, then promote to Custom IOAs in detect mode; escalate Q2 to block once clean. Q3 hashes and the 91.132.163.78 IP → Custom IOC Management (block).

One-click blocks for SOC tooling. Hashes and the exfil IP are Sekoia/YesWeHack-published; swap expirations to fit your policy. The Mapbox/DoH domains are legitimate services abused as carriers — hunt/scope, do not blanket-block.

type,value,action,severity,expiration,description,tags
ipv4,91.132.163.78,block,critical,2026-12-31,ChocoPoC exfil server,tool:ChocoPoC;kind:exfil
sha256,93739477cd379adef95126b22758c0e644282d2028dd297328ce856fa111dd06,prevent,critical,2026-12-31,skytext v1.1.0,tool:ChocoPoC;pkg:skytext
sha256,17997e9e0256d0f5d5d21a4852c37f16b338e4bb9c2bec09bdfd822b24aa76b4,prevent,critical,2026-12-31,frint v0.1.2,tool:ChocoPoC;pkg:frint
sha256,5abd45d6f4a1705dca55d882f017d4768888dce9ad99cea40b3da35c23de5cae,prevent,critical,2026-12-31,slogsec,tool:ChocoPoC;pkg:slogsec
sha256,40569318e89db751ff3886b2617d990d8a343f0d1d8727b7f978a28129ca36bc,prevent,critical,2026-12-31,gradient.pyd Windows payload,tool:ChocoPoC;kind:payload
sha256,320b29844892e3c59bc6fcb07e701b2b3230a37cb4a13176174e9e294ec6d43e,prevent,critical,2026-12-31,gradient.so Linux payload,tool:ChocoPoC;kind:payload

[ ChocoPoC behaviors ]
- pip install of skytext / frint / slogsec / logcrypt.cryptography
- gradient.so (Linux) or gradient.pyd (Windows) in a skytext pkg dir
- Payload activates only if EXPLOIT_POC.py / exploit_poc.py present
  (filename-hash gate 0xF4835C9C) - dormant in bare sandboxes
- Python process reading browser Login Data / cookies / logins.json
- DNS to api.mapbox.com dead drop + DoH (alidns / cloudflare-dns)
  with domain fronting
- Bulk exfil to 91.132.163.78:8001
  (/assets/static/bundle.ext.min.de5b2bc9.js)
- Persistence: _distutils_hack/override.py + distutils-precedence.pth
- Env markers ZEBUWIAKGPHOQAP006 / JKHWQVEKRASDF12
- git clone of lincemorado97 / ogenich / bolubey CVE repos

Malware:  ChocoPoC (Python RAT) - Sekoia / YesWeHack
Prior:    slogsec + logcrypt.cryptography (late-2025, same operator)
Delivery: PyPI frint -> skytext -> gradient.so / gradient.pyd
C2:       api.mapbox.com dataset dead drop (DoH + domain fronting)
Exfil:    91.132.163.78:8001
Fake PoC repos (7 known):
  github.com/lincemorado97/CVE-2025-64446_CVE-2025-58034
  github.com/lincemorado97/CVE-2025-55182_CVE-2025-66478
  github.com/lincemorado97/CVE-2025-14847
  github.com/ogenich/CVE-2026-10520
  github.com/ogenich/CVE-2026-48908
  github.com/bolubey/CVE-2026-0257
  github.com/bolubey/CVE-2026-50751

[ ] Run untrusted PoCs only in a disposable, network-isolated VM/container
[ ] Inventory dev/CI hosts for skytext / frint / slogsec / logcrypt.cryptography
[ ] Sweep site-packages for gradient.so / gradient.pyd + distutils-precedence.pth
[ ] Block egress to 91.132.163.78; alert Python -> api.mapbox.com / DoH resolvers
[ ] Internal PyPI proxy: allow-list / quarantine new/low-reputation packages
[ ] Separate offensive-security tooling from production identities/SSO
[ ] Rotate creds/cookies on any host that ran a suspect PoC
[ ] Disable/monitor DoH from endpoints so covert resolution is visible

• Telemetry ready: Confirm ProcessRollup2, PeFileWritten/FileCreateInfo, DnsRequest and NetworkConnectIP4 are flowing from developer/research/pentest hosts — and that Falcon for Linux is deployed on Linux engineering hosts, since skytext was primarily downloaded on Linux.
• Benign baseline: Run Q6 and Q7 (Python egress) over 7–14 days on engineering hosts; record sanctioned Python apps that call Mapbox/Cloudflare, and exclude those before alerting.
• Positive test: In an isolated VM, pip install a harmless package renamed skytext and confirm Q1 fires; drop a benign file named gradient.pyd into site-packages and confirm Q2 fires; add a firewall log/route to 91.132.163.78 and confirm Q4 fires.
• Promotion: Only promote Q1/Q2/Q4/Q5 to detect/block after zero benign hits across the baseline window. Q8 stays hunt-only (FP high).

P1 · Inventory hosts for the malicious ChocoPoC packages (cross-platform)

# Linux / macOS (bash) — run on dev/research hosts or via your fleet tool
for p in skytext frint slogsec logcrypt.cryptography; do
  pip show "$p" 2>/dev/null | grep -E '^(Name|Version|Location):' && echo "FOUND: $p"
done
# Also sweep site-packages for the payload:
find / -type f \( -name 'gradient.so' -o -name 'gradient.pyd' \) 2>/dev/null

P2 · Windows — find the gradient payload and malicious packages

# PowerShell
Get-ChildItem -Path "$env:LOCALAPPDATA\Programs\Python","C:\Python*","$env:APPDATA\Python" `
  -Recurse -Include 'gradient.pyd','gradient.so' -ErrorAction SilentlyContinue |
  Select-Object FullName, Length, LastWriteTime,
    @{n='SHA256';e={(Get-FileHash $_.FullName -Algorithm SHA256).Hash}}
foreach ($p in 'skytext','frint','slogsec') { pip show $p 2>$null }

P3 · Block the exfil server (stopgap host firewall)

# Windows
New-NetFirewallRule -DisplayName 'Block ChocoPoC exfil 91.132.163.78' `
  -Direction Outbound -Action Block -RemoteAddress 91.132.163.78
# Linux (iptables)
iptables -A OUTPUT -d 91.132.163.78 -j DROP
# Prefer an enterprise egress/proxy block; host rules are a per-host stopgap.

P4 · Remove ChocoPoC packages + payload from a confirmed host

# After isolating the host and collecting evidence:
pip uninstall -y skytext frint slogsec logcrypt.cryptography 2>/dev/null
find / -type f \( -name 'gradient.so' -o -name 'gradient.pyd' \
  -o -name 'distutils-precedence.pth' \) -print 2>/dev/null
# Manually review/restore _distutils_hack/override.py from a clean setuptools;
# then rotate every credential/cookie that was present on the host.

Detection is strongest at the supply-chain delivery (package install, payload write, repo clone), the atomic hashes, and the dedicated exfil IP — all low-FP. The Mapbox dead-drop is deliberately hidden behind DoH + domain fronting, so C2 detection is partial and best paired with making DoH visible (§12). Browser credential theft and the in-process sandbox gate are gaps addressed via native file-access hunts (§7) and disposable-VM policy.