SIGNALMONK
خبير أمن اللاسلكي وRFID
الملف المهني
يقود SignalMonk العمليات الأمنية على Wi‑Fi وBLE وRFID وإنترنت الأشياء اللاسلكي.
المهارات الأساسية
التنصت على اللاسلكي؛ استغلال BLE؛ كشف استنساخ RFID؛ اتصالات IoT آمنة؛ التحليل الجنائي اللاسلكي
أبرز الإنجازات
كشف سرقة مؤسسية عبر بطاقات دخول مستنسخة.
مقالات بقلم SIGNALMONK
Portuguese Language, Criminal Precision: Why a Brazilian Banking Trojan Fits Portugal So Well
A banking trojan moving through Portugal highlights a familiar fraud tactic: attackers often win by matching the victim's language, not just their code.
Thousands of GitHub Repos, One Familiar Trap: How FakeGit Turned Trust Into Delivery
A sprawling repository-abuse campaign linked to FakeGit used roughly 7,600 GitHub repos and more than 14 million downloads to push SmartLoader and StealC, showing how platform trust can become malware transport.
Ethereum’s Public Ledger Becomes a Hiding Place for Malware Control
A reported Amatera Stealer campaign uses Ethereum smart contracts to obscure command-and-control endpoints, showing how attackers can twist public blockchain features into infrastructure camouflage.
The Evasion Market Behind Commodity RATs Is Getting Sharper
Cruciferra is being tied to an industrial-style malware chain that pairs email lures with defense evasion, then drops familiar remote access tools onto targeted systems.
When Release Automation Turns Hostile: The AsyncAPI npm Incident and the Trust Problem Behind It
A reported package-publishing compromise in the AsyncAPI ecosystem shows how GitHub Actions, npm trust, and generator tooling can become a malware delivery path when release controls are subverted.
Machine-Readable Malware: Fake AI Skills Turn Trust Into a Delivery Channel
A malware campaign used deceptive GitHub repositories and AI-facing registry surfaces to make a loader look like a useful project, showing how quickly trusted setup paths can be turned against developers and agents.
When a Calendar Becomes a Command Line: The HOLLOWGRAPH Abuse of Microsoft 365
A Windows malware sample has been tied to a covert Microsoft Graph channel that turns a Microsoft 365 calendar into a hidden rendezvous point for attacker instructions.
When a Calendar Becomes a Command Line: HollowGraph and the New SaaS Hideout
A newly described espionage implant is using Microsoft 365 calendar objects as a covert relay, showing how trusted cloud APIs can double as low-noise channels for command and data theft.
Browser Fraud Gets a Sharper Edge as TELEPUZ Enters the Session
A reported ClickFix-to-VIDAR chain ends in a web injector that can steal cookies, run JavaScript, and alter IBAN details inside live banking sessions.
The Wallet Trap No Hardware Chip Can Stop
A modular malware framework is being tied to fake GitHub lures and ClickFix-style prompts, but the real prize is not the device - it is the recovery seed typed into the wrong screen.
The Loader That Hid in Plain Sight: Malware Split Across 364 Windows Variables
A staged Windows chain used JScript, hidden PowerShell, and in-memory .NET execution to keep its payload off disk and harder to spot.
When the Attachment Is the Trap: A Windows Script Chain Built to Hide in Plain Sight
A phishing-laced loader is using archive-delivered JScript, PowerShell, and in-memory .NET execution to shrink the clues defenders usually depend on.
The New Stealer Trap: How Attackers Turned Windows Convenience Into Credential Theft
A recent ACR Stealer campaign shows how social engineering, remote file delivery, and hidden scripting can work together to steal browser credentials and session tokens without a classic exploit chain.
Daxin Returns on a Taiwan Manufacturing Host, and a Second Backdoor Raises the Stakes
A kernel-level implant and a pre-login Windows backdoor were found together, but their exact relationship and full impact remain unconfirmed.
ClickLock Stealer and the New Mac Trap: When the User Becomes the Bypass
A macOS infostealer is drawing attention for leaning on social engineering and process disruption rather than a flashy exploit chain.
TELEPUZ and the Trap of the Helpful Website
A modular malware campaign tied to ClickFix lures shows how a single user action can become the start of a much larger compromise.
OkoBot Turns Crypto Security Into a Trap of Prompts, Extensions, and Stolen Secrets
The malware case shows how one hostile workflow can move from fake software delivery to browser abuse and wallet-app surveillance, all aimed at crypto credentials.
Shared Chat Links, Silent Theft: How a Claude Lure Became a Mac Malware Trap
A ClickFix-style campaign is reportedly using shared Claude chats as bait, showing how a normal collaboration feature can be repurposed into a trust channel for macOS credential theft.
npm’s Hidden Detour: 148 Fake Proxy Packages Turned Ordinary Browsers into DDoS Traffic
A short-lived package campaign shows how a public registry can be abused as a delivery layer for browser-side attack traffic, not just as a place to publish software.
Shortcut Trap, Cloud Link, Blockchain Path: A Clean-Looking Email Chain Hides a Dirty Payload
A booking-themed phishing wave aimed at hospitality workflows shows how attackers can stack ordinary tools - cloud sharing, ZIP files, LNK shortcuts, PowerShell, and Node.js - into a delivery chain that is harder to spot and block.