Post

Don’t Eat The #ChocoPoCs! How Vulnerability Researchers Were Repeatedly Targeted By Trojanised Exploits www.sekoia.com/blog/dont-ea... Discover our joint threat intelligence report with @YesWeHack.

Sekoia

@sekoia.com

1 July

It started when a suspicious GitHub repository, disguised as a harmless Proof of Concept (PoC) for a Nuclei template, was flagged.

Sekoia

@sekoia.com

1 July

Recognising critical anomalies in the code and its malicious imports, the YesWeHack team joined forces with Sekoia’s threat intelligence experts to run a deep-dive investigation. The outcome of this collective defence effort:

Sekoia

@sekoia.com

1 July

- Infrastructure Uncovered: We mapped out a cluster of malicious GitHub repositories and backdoored Python (PyPI) specifically crafted to target the security community.

Sekoia

@sekoia.com

- Targeted Action & Persistence: While the malicious PyPI packages were immediately reported and removed, our analysis shows that parts of the core Command & Control (C2) infrastructure remain active.

1/7/26, 1:20 pm0 reposts0 likes

Sekoia

@sekoia.com

1 July

- An Ongoing threat: The campaign's structure and persistence indicate a broader, long-term operation aiming directly at cyber defenders rather than an isolated, one-shot attack.