SIGNALMONK
خبير أمن اللاسلكي وRFID
الملف المهني
يقود SignalMonk العمليات الأمنية على Wi‑Fi وBLE وRFID وإنترنت الأشياء اللاسلكي.
المهارات الأساسية
التنصت على اللاسلكي؛ استغلال BLE؛ كشف استنساخ RFID؛ اتصالات IoT آمنة؛ التحليل الجنائي اللاسلكي
أبرز الإنجازات
كشف سرقة مؤسسية عبر بطاقات دخول مستنسخة.
مقالات بقلم SIGNALMONK
When a Blogspot Page Becomes the First Stage of an Attack
Veil#Drop shows how trusted hosting, JavaScript, and PowerShell can be chained into a delivery path for stealer malware without obvious disk-based traces.
QuimaRAT Turns Java Into a Cross-Platform Crime Product
A newly flagged Java-based RAT shows how malware can be packaged like a service, with one codebase aimed at Windows, Linux, and macOS.
When a Package Update Becomes the Break-In Point
A new FBI warning on TeamPCP puts the software supply chain back under the microscope, with package timing, trusted tools, and secret hygiene now part of the threat model.
Inside the TimbreStealer Trail: A Windows Loader Game Built to Slip Past the Guardrails
A TimbreStealer campaign tied to Mexican companies points to a familiar but stubbornly effective pattern: localized lure material, DLL side-loading, and anti-analysis engineering designed to slow defenders down.
Fake Utility, Real Password Risk: Inside the Mac Stealer Dressing Up as Maccy
A compiled AppleScript lure, a cloned download page, and a local authentication check show how macOS trust can be turned against the user.
When a Fake Transcript Becomes the Doorway: PureLog Stealer’s Quiet Web Trap
A deceptive file name, compromised websites, and PowerShell show how modern infostealers can lean on trust rather than flashy exploits.
When Residential Proxies Become the Mask: A Disruption Hits the Abuse Layer
Google said it disrupted a residential proxy botnet used for malware control traffic and password spray attacks, with FBI, Lumen, and other partners involved.
Umbrij and the New Credential Crime: Turning Gmail Sessions Into API Access
The reported malware chain targets Google’s OAuth flow, showing how a live browser session can become the real prize in email compromise.
Search Results Became the Delivery Layer in a ScreenConnect Abuse Campaign
A multi-language lure tied to freeware searches shows how SEO manipulation can turn ordinary browsing into a path toward unwanted remote-access software.
ValleyRAT’s New Push Shows How Fake Installers Still Beat Trust
A renewed ValleyRAT wave uses installer lures and Japanese-language email bait to turn ordinary Windows trust decisions into remote-control risk.
Ousaban Turns a Banking Lure Into a Region-Tested Trap
A phishing chain aimed at Spain and Portugal pairs a deceptive PDF with geofencing, steganography, and rotating command infrastructure to make analysis harder.
When a Phishing Page Decides Who Gets the Trojan
A selective Ousaban campaign targeting Spain and Portugal shows how geofencing and staged delivery can turn a simple lure into a tightly controlled malware gate.
When the PoC Is the Payload: A GitHub Trap Built for Security Hunters
A reported campaign called ChocoPoC turns the normal rush for fresh exploit code into an infection path, using fake GitHub PoC repositories to deliver a Python RAT and target browser-stored secrets.
When a Web Server Becomes a Hidden Foothold
An incident response investigation found an attack chain built on disabled defenses, a steganographic web shell, and Mimikatz, then repeated reuse of a server that had not been fully cleaned.
One Stealer IP, a Hidden Maritime Scam Grid
A single RedLine-linked host became the starting point for mapping infrastructure that appears designed for maritime-themed spear phishing and BEC support.
When a Signed Driver Turns Into a Blindfold for EDR
Ransomware operators are leaning on vulnerable Windows kernel drivers to weaken endpoint defenses before encryption starts, and the trust model itself is part of the problem.
Fake Perplexity Extension Turned Chrome Searches Into a Quiet Target
A lookalike browser add-on used a trusted AI brand to win installs, showing how extension permissions can turn ordinary searches into sensitive telemetry.
SimpleHelp Login Trust Broken, Malware Chain Follows
A critical authentication bypass in SimpleHelp’s OIDC flow may have let attackers obtain technician access and deliver two malware families, turning a remote support tool into a high-risk entry point.
The DLL That Wore a Security Badge: Mistic’s Quiet Path Into Windows
A new Windows backdoor is reportedly hiding behind a Microsoft-style component name, using DLL sideloading and self-cleaning behavior to make incident response harder.
Millenium RAT’s Windows Push Points to a Cleaner, Harder-to-Hunt Malware Model
Group-IB’s analysis of Millenium RAT v4.* ties 62,289 Windows infections in more than 160 countries to Telegram bot communication, a combination that can blur malicious traffic inside ordinary cloud use.