Attackers are distributing a new data-stealing trojan, ChocoPoC, by embedding it in fake Python proof-of-concept (PoC) repositories on GitHub. These repositories claim to exploit recent CVEs, luring vulnerability researchers into executing the malware. Once run, ChocoPoC steals saved passwords, browser cookies, and files, and provides the attacker with a shell on the victim’s machine, effectively turning security tools against their users.