SIGNALMONK
خبير أمن اللاسلكي وRFID
الملف المهني
يقود SignalMonk العمليات الأمنية على Wi‑Fi وBLE وRFID وإنترنت الأشياء اللاسلكي.
المهارات الأساسية
التنصت على اللاسلكي؛ استغلال BLE؛ كشف استنساخ RFID؛ اتصالات IoT آمنة؛ التحليل الجنائي اللاسلكي
أبرز الإنجازات
كشف سرقة مؤسسية عبر بطاقات دخول مستنسخة.
مقالات بقلم SIGNALMONK
npm’s Trust Chain Turns Toxic in the MALFEX Package Cluster
A Windows-focused npm supply-chain campaign shows how a routine dependency install can become a delivery path for remote access malware and credential-stealing code.
Poem-Driven C2: The Hidden Trick Behind a New Wave of AI-Service Malware
A malware campaign called PoeLLM is using a GitHub-hosted poem to help infected servers find command-and-control infrastructure, showing how exposed AI and developer tools can be turned into a control plane.
When Malware Reads the Ledger: The New Problem of Blockchain-Powered C2
Security research points to a supply-chain tactic in which public blockchains help malware refresh its command infrastructure after it is already on a compromised system.
A Poisoned npm Release Turned a Trusted Name into a Supply-Chain Trap
A single malicious package version can become a delivery system for secret theft, credential abuse, and wider propagation risk across developer workflows.
CastleStealer’s New Trick Turns a Stealer Into a Live Intrusion Tool
A C# infostealer first seen in April 2026 is now reported to carry remote shell capability, a shift that can turn stolen data into active command execution on compromised machines.
MATCHBOIL Grows Teeth: The Malware That Learned to Hide Better
A C# downloader is not supposed to look like a hardened implant, but MATCHBOIL now carries sandbox checks, commercial .NET obfuscation, deceptive interfaces, and recurring command-and-control traffic.
When a Terraform Plugin Turns Into a Workplace Intruder
A malicious Terraform provider has reportedly been used to steal developer credentials and plant backdoors, showing how infrastructure automation can become an execution path for cross-platform compromise.
Phones That Arrive Dirty: The Hidden Risk of Malware in Android Firmware
A preloaded Android threat on low-cost handsets is a reminder that sometimes the compromise starts before the first tap, not after the first download.
Fake Verification Screens Are the New Malware Conveyor Belt
A campaign tied to more than 100 compromised websites shows how a trusted page can be turned into a command prompt for the victim's own Windows machine.
Fake Verification, Real Payload: How Compromised Sites Became Stealers’ Delivery Lines
A wave of injected JavaScript turned more than 100 websites into a trust trap, using a fake Cloudflare-style check to push LunexStealer through a user-driven execution chain.
When a Common Setup Tool Becomes Botnet Cover: Cling and the Quiet Abuse of STUN
A botnet tied to internet-exposed IoT and networking devices shows how ordinary NAT-traversal traffic can be repurposed to hide command-and-control behavior.
Linux Backdoor ClingSTUN Turns a Standard NAT Tool into a Hidden Reachability Layer
A malware family tied to abused STUN traffic and boot-time persistence shows how ordinary network plumbing can be repurposed to keep compromised Linux devices reachable.
ClingSTUN and the Quiet Theft of IoT: When Backdoors Turn Devices into Relay Infrastructure
A Linux backdoor tied to 24 IoT vulnerabilities shows how routine device exposure can be repurposed into remote access and proxy infrastructure.
The Perimeter’s Fake Face: Linux Backdoors That Pose as Mail Security Gear
Three newly identified Linux implants imitate legitimate Asian mail-security products, turning trusted-looking edge software into a camouflage layer for stealthy access.
A Fake Zoom Installer Smuggled a Universal macOS Backdoor
A counterfeit Zoom package targeting Macs carried CloudSyncD, a backdoor wrapped inside a universal Mach-O payload and extracted only when the installer ran.
When a Banking Trojan Turns Android’s Trust Features Against It
RATHat shows how a mobile trojan can chain Accessibility access, wireless debugging, and a disputed AI label into something closer to device control than simple credential theft.
Python Infostealer Hunts Browser Secrets in a Nested Archive Trap
A Windows malware sample packaged in layered archives is reported to target passwords, cookies, card data, and session tokens across 17 browsers, turning everyday browser storage into a high-value target.
RATHat Turns Android’s Trusted Controls Into a Criminal Workflow
A reported banking trojan pairs lure apps, background services, and abused developer features with AI-assisted operator tactics to press into Android devices.
SectopRAT’s Real Trick: Hiding Inside Familiar Software to Hunt Wallets and Browser Secrets
The danger is not a flashy zero-day here, but a quieter abuse of trust: malware tucked into legitimate software components, with browser credentials and crypto wallets in its crosshairs.
When Malware Learns to Ask for Help: Android Fraud Gets a Model-Assisted Upgrade
A newly documented Android banking trojan called RATHat is a reminder that mobile crime is starting to borrow the language of AI to move faster and look less scripted.