Cyber Threat Brief — Issue #012

A campaign called ChocoPoC, documented jointly by YesWeHack and Sekoia on July 1, 2026, has been hiding a fully functional remote access trojan inside fake proof-of-concept exploit repositories on GitHub since late 2025. The attack exploits a specific behavior of the security research community: when a major CVE is disclosed, researchers race to find working exploit code to test it. Attackers create fake GitHub repositories that appear to be legitimate PoC exploits for high-profile vulnerabilities including FortiWeb, PAN-OS, Ivanti Sentry, Check Point VPN, and Joomla. The visible exploit code looks clean. The malware hides inside a Python dependency that the PoC pulls in when the researcher runs pip install. The malicious package, called skytext, was downloaded approximately 2,400 times. Once a researcher runs the PoC, the malware activates only after verifying that a legitimate exploit file is present, which causes it to remain dormant in automated sandbox environments. It then steals saved browser passwords, cookies, and files, and establishes a persistent remote shell. Command and control runs through Mapbox, a legitimate mapping platform, making the traffic difficult to distinguish from normal web activity. Security researchers are high-value targets because compromising one can provide access to client credentials, private vulnerability reports, and details of active security engagements across multiple organizations simultaneously.

CISA added CVE-2026-45659, a remote code execution vulnerability in on-premises Microsoft SharePoint Server, to the Known Exploited Vulnerabilities catalog on July 1, 2026, with a federal remediation deadline of July 4. The flaw is a deserialization vulnerability that allows any authenticated user with basic site member permissions to execute arbitrary code on the server remotely. No administrator access is required. No user interaction is required. An attacker with a stolen or phished low-privilege account can run code on SharePoint and use it as a launchpad into the broader network. Microsoft patched the flaw in May 2026 and initially assessed exploitation as unlikely. CISA's KEV inclusion confirms that assessment was wrong. Separately, Microsoft has disclosed an incident where two unrelated ransomware actors were simultaneously present on the same network, with Storm-2603 deploying Warlock ransomware through SharePoint exploitation. SharePoint contains sensitive business documents and integrates with Active Directory, making a successful compromise a direct path to lateral movement across the organization.

Kaspersky researchers disclosed this week that ToddyCat, a China-linked advanced persistent threat group, has developed a new malware family called Umbrij specifically designed to access corporate email through the Google API rather than through traditional credential theft. The malware establishes access to a victim's Gmail account by stealing an OAuth token, the digital credential that lets applications access Google services on a user's behalf. Once Umbrij has the token, it connects to Gmail's management console in headless mode through a remote debugging port and silently reads the victim's email correspondence without triggering standard authentication alerts. The technique bypasses traditional detection methods because it uses Google's own legitimate API. From Google's perspective, the access looks like an authorized application reading mail. ToddyCat's use of this technique represents a significant escalation in OAuth-based espionage tradecraft, turning the same authorization mechanism that powers legitimate productivity tools into a covert email exfiltration channel.