SIGNALMONK
خبير أمن اللاسلكي وRFID
الملف المهني
يقود SignalMonk العمليات الأمنية على Wi‑Fi وBLE وRFID وإنترنت الأشياء اللاسلكي.
المهارات الأساسية
التنصت على اللاسلكي؛ استغلال BLE؛ كشف استنساخ RFID؛ اتصالات IoT آمنة؛ التحليل الجنائي اللاسلكي
أبرز الإنجازات
كشف سرقة مؤسسية عبر بطاقات دخول مستنسخة.
مقالات بقلم SIGNALMONK
Package Trust Under Siege: Miasma’s Latest Move Cuts Across npm, GitHub Actions, and Go
The latest Miasma-linked supply-chain activity shows how a single poisoned release can pressure multiple trust layers at once, from package registries to build automation.
Trusted npm Packages Become the Doorway in a Quiet Secret-Harvesting Campaign
A poisoned-package wave tied to Mini Shai-Hulud, Miasma, and Hades is pushing supply-chain risk into the heart of developer workstations and CI/CD pipelines.
LokiBot’s New Cover Story: Hashes, Legacy Crypto, and a Harder Target for Analysts
A new loader variant shows LokiBot using API hashing and 3DES-encrypted C2 configuration to make static analysis harder.
Old Malware, New Script Chain: Why LokiBot Still Fits Modern Windows Defense Gaps
A recent LokiBot campaign pairs obfuscated JScript with PowerShell, showing how native Windows scripting can still carry commodity credential theft past noisy perimeter controls.
SharkLoader Turns Trusted Windows Paths into a Quiet Launchpad
A newly named loader linked to the StrikeShark cluster shows how public-facing application exposure, DLL side-loading, and in-memory staging can turn a routine foothold into a much harder problem.
ClawHub Malicious Skills Deliver macOS Infostealers Through Base64 curl-pipe-bash Droppers
CyberPress reports that malicious skills in ClawHub are being used to deliver macOS infostealers via Base64-encoded curl-pipe-bash droppers.
SharkLoader Turns a Diplomatic Intrusion Into a Broader Beacon Problem
A newly named loader family linked to StrikeShark shows how a small foothold can become a wider intrusion chain when the real goal is to stage Cobalt Strike Beacon.
When Crimeware Loses Its Nervous System, the Hustle Slows Down
A coordinated disruption of infrastructure linked to Amadey and StealC shows why takedowns aimed at command channels can matter even when infected machines are still out there.
Why a Quiet Backdoor Matters More Than a Loud Ransom Note
Mistic looks less like a headline-grabbing smash-and-grab and more like the kind of foothold that can be traded, reused, or handed off inside the ransomware economy.
Fake Outlook Page, Real Endpoint Risk: The Browser Backdoor Playbook Behind Edgecution
A lookalike update portal and a malicious Edge extension show how a browser lure can turn into a path toward local process control when native messaging is in play.
When a RAR File Becomes a Delivery System for Windows Persistence
A targeted campaign tied to Ukraine’s UAV ecosystem shows how a booby-trapped archive, a script loader, and a decoy document can turn routine file handling into a foothold.
When a Mac App Becomes a Moving Target: The FlutterShell Case
A macOS malware family linked to remote JavaScript delivery shows how attackers can shift meaningful logic off the binary and into infrastructure that can change at any time.
When Flutter and WebViews Become a Backdoor’s Quietest Route
A macOS malware family named FlutterShell shows how ordinary app frameworks can be repurposed for runtime command execution without looking like a classic implant.
When Malware Moves by Itself, the Clock Starts Ticking
A virus and a worm may sound like close cousins, but their propagation model changes the defensive playbook, the speed of spread, and the window to contain damage.
Prinz Eugen Bets on Speed: The New Ransomware Trick That Hides in Plain Sight
A fresh ransomware operation is focusing on the files people touched most recently while skipping the usual on-screen ransom note, a combination that complicates fast detection.
When Browser Locks Meet Malware Tricks: Vidar and the Chrome Secret Hunt
A reported Vidar technique shows how browser hardening can push infostealers toward live Windows process abuse instead of simple file theft.
SocGholish Under Pressure as Police Target Its Malware Network
An international operation targeted SocGholish infrastructure, a reminder that disrupting a loader can matter as much as stopping the final payload.
When a Clipper Hides Behind Tor, the Hunt Moves Off the Network Map
A Windows crypto-clipper campaign is notable less for the theft itself than for the way it routes control through a local SOCKS5 proxy and Tor, reducing the value of simple IP-based hunting.
Rokarolla Shows How Android Phones Become Banking Tools for Crime
The Android trojan is described as targeting 200 applications and taking control of infected devices, a reminder that mobile fraud often begins with trust abuse, not brute force.
When Fake Popularity Becomes the Delivery System for Crypto Malware
A lure built on manipulated reputation signals is turning trusted software hubs into a launchpad for clipboard hijackers aimed at crypto users.