✅ Report Title: Operation FalseProof: PoC that Bites Back

*This analysis report was presented at Virus Bulletin 2026 (VB2026).

✅ Executive Summary:

• S2W TALON identified Operation FalseProof, a software supply chain attack campaign targeting security researchers through modified GitHub PoCs and malicious PyPI packages.
• The campaign used SporeDrop, MeridianSpy, and CoDawnloader, with MeridianSpy abusing the Mapbox Datasets API for command and control.
• S2W tracks the activity as UNSI-022 and assesses a possible connection to a Chinese-speaking threat actor with low confidence.
• The campaign shows that security research workflows have become part of the software supply chain attack surface.

📌 Key Takeaways

• (Understanding the Researcher-Focused Supply Chain Attack) Examine how Operation FalseProof targeted security researchers by distributing cloned vulnerability PoCs through GitHub and inserting malicious PyPI packages into their dependency chains.
• (Insights into the Malware Execution Chain) Understand how the campaign abused Python's native import precedence and context-aware execution to deliver SporeDrop, MeridianSpy, and CoDawnloader while minimizing visible changes to the original PoCs.
• (Tracking UNSI-022 and Assessing Attribution Signals) Review the activity tracked by S2W under the designation UNSI-022, including the use of SM3 and similarities with the UAT-6382 campaign. These findings suggest a possible link to a Chinese-speaking threat actor, but the attribution remains low confidence due to the potential for code reuse and deliberate false flagging.
• (Building Proactive PyPI Supply Chain Defense) Explore an AI-assisted detection system that analyzes package metadata, dependency relationships, archive structures, native extensions, and sandbox behavior to identify suspicious PyPI packages before installation.