---
id: 4144
title: "Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits"
source_domain: yeswehack.com
source_url: "https://www.yeswehack.com/news/chocopocs-vulnerability-researchers-trojanised-exploits"
published_at: "2026-07-01 11:35"
tags: ["supply-chain", "featured", "vulnerability-research", "threat-intelligence", "malware", "poc", "incident", "python-rat"]
phying_url: "https://phying.com/item/4144"
lang: en
---

# Don’t eat the ChocoPoCs! How vulnerability researchers were repeatedly targeted by trojanised exploits

## Summary

A suspicious contribution request led YesWeHack and Sekoia researchers to uncover sophisticated malware targeting the vulnerability research supply chain.

## Why it matters

Trojanized proof-of-concept exploits turn the vulnerability-research workflow itself into an attack surface. Researchers should isolate, inspect and verify exploit code before execution.

## Intelligence Metadata

- **Sources:** yeswehack.com
- **Published:** 2026-07-01 11:35
- **Original:** https://www.yeswehack.com/news/chocopocs-vulnerability-researchers-trojanised-exploits
- **Phying News:** https://phying.com/item/4144