SIGNALMONK
خبير أمن اللاسلكي وRFID
الملف المهني
يقود SignalMonk العمليات الأمنية على Wi‑Fi وBLE وRFID وإنترنت الأشياء اللاسلكي.
المهارات الأساسية
التنصت على اللاسلكي؛ استغلال BLE؛ كشف استنساخ RFID؛ اتصالات IoT آمنة؛ التحليل الجنائي اللاسلكي
أبرز الإنجازات
كشف سرقة مؤسسية عبر بطاقات دخول مستنسخة.
مقالات بقلم SIGNALMONK
When a Fake Official App Becomes a Remote Control Panel
Flying Eagle shows how Android accessibility can be twisted into a spyware toolkit when a convincing government-themed lure gets a user to install the wrong app.
When a Package Install Turns into a Hidden Control Channel
A reported npm supply-chain operation shows how transitive dependencies can turn a routine developer install into a cross-platform remote access risk.
Trusted npm Names, Poisoned Builds: The AsyncAPI Package Incident Exposes a Quiet Supply-Chain Trap
Malicious releases in the AsyncAPI ecosystem highlight how a single dependency can put developer tokens, cloud keys, and CI/CD secrets within reach of build-time code.
When Killing the Bot Makes Things Worse: Tengu’s Reboot Loop for Linux Devices
A Mirai-lineage botnet is turning a built-in safety feature into an anti-remediation trick, showing how exposed Linux appliances can be harder to clean than they look.
Tengu’s Quiet Trick: A Mirai Offshoot That Fights the Reboot Button
This Linux botnet blends DDoS muscle with persistence and watchdog abuse, turning basic cleanup steps into a harder technical problem.
The Windows Shadow Market Behind Cruciferra
A crypter called Cruciferra sits at the junction of malware packing, vulnerable-driver abuse, and process ghosting, showing how Windows stealth can be layered rather than improvised.
TrickBot’s Quiet Channel: DNS Tunneling Turns Routine Traffic into a Cover Story
A reported TrickBot variant is using DNS tunneling for command-and-control, a reminder that the most ordinary network services can become the hardest to watch.
Golden Chickens Returns with a Sharper, More Modular Browser Theft Kit
The long-running MaaS ecosystem appears to be refining its playbook around lightweight access, modular implants, and browser-focused theft, a combination that can complicate detection and response.
Golden Chickens Bets on Smaller Malware Pieces to Chase Browser Secrets
The group known as Golden Chickens is being tied to four modular malware families, a design shift that matters because browser theft is increasingly about live sessions, not just saved passwords.
The Fake Plugin Trick Turning a Text Editor into a Malware Disguise
A malicious add-on dressed as a Notepad++ plugin shows how attackers can weaponize trusted extension workflows on Windows without needing a flashy exploit.
TrickBot’s New Whisper Channel: DNS Turns a Familiar Malware Family Harder to See
A TrickBot variant is described using DNS tunneling for command-and-control, a shift that changes which logs defenders need to trust first.
Portuguese Language, Criminal Precision: Why a Brazilian Banking Trojan Fits Portugal So Well
A banking trojan moving through Portugal highlights a familiar fraud tactic: attackers often win by matching the victim's language, not just their code.
Thousands of GitHub Repos, One Familiar Trap: How FakeGit Turned Trust Into Delivery
A sprawling repository-abuse campaign linked to FakeGit used roughly 7,600 GitHub repos and more than 14 million downloads to push SmartLoader and StealC, showing how platform trust can become malware transport.
Ethereum’s Public Ledger Becomes a Hiding Place for Malware Control
A reported Amatera Stealer campaign uses Ethereum smart contracts to obscure command-and-control endpoints, showing how attackers can twist public blockchain features into infrastructure camouflage.
The Evasion Market Behind Commodity RATs Is Getting Sharper
Cruciferra is being tied to an industrial-style malware chain that pairs email lures with defense evasion, then drops familiar remote access tools onto targeted systems.
When Release Automation Turns Hostile: The AsyncAPI npm Incident and the Trust Problem Behind It
A reported package-publishing compromise in the AsyncAPI ecosystem shows how GitHub Actions, npm trust, and generator tooling can become a malware delivery path when release controls are subverted.
Machine-Readable Malware: Fake AI Skills Turn Trust Into a Delivery Channel
A malware campaign used deceptive GitHub repositories and AI-facing registry surfaces to make a loader look like a useful project, showing how quickly trusted setup paths can be turned against developers and agents.
When a Calendar Becomes a Command Line: The HOLLOWGRAPH Abuse of Microsoft 365
A Windows malware sample has been tied to a covert Microsoft Graph channel that turns a Microsoft 365 calendar into a hidden rendezvous point for attacker instructions.
When a Calendar Becomes a Command Line: HollowGraph and the New SaaS Hideout
A newly described espionage implant is using Microsoft 365 calendar objects as a covert relay, showing how trusted cloud APIs can double as low-noise channels for command and data theft.
Browser Fraud Gets a Sharper Edge as TELEPUZ Enters the Session
A reported ClickFix-to-VIDAR chain ends in a web injector that can steal cookies, run JavaScript, and alter IBAN details inside live banking sessions.