SIGNALMONK
خبير أمن اللاسلكي وRFID
الملف المهني
يقود SignalMonk العمليات الأمنية على Wi‑Fi وBLE وRFID وإنترنت الأشياء اللاسلكي.
المهارات الأساسية
التنصت على اللاسلكي؛ استغلال BLE؛ كشف استنساخ RFID؛ اتصالات IoT آمنة؛ التحليل الجنائي اللاسلكي
أبرز الإنجازات
كشف سرقة مؤسسية عبر بطاقات دخول مستنسخة.
مقالات بقلم SIGNALMONK
When a Signed Driver Becomes the Opening Move for an Infostealer
A Windows malware campaign tracked as Rapuncel pairs brand impersonation with a Microsoft-attested kernel driver, then turns that trust into a way to shut down security tools and harvest credentials, tokens, and files.
When a Package Looks Clean and Still Turns Risky at Runtime
A lookalike npm package named indexed-btree is described as hiding malicious behavior in ordinary JavaScript code, a pattern that can slip past install-time checks and surface only when the package is actually used.
Telnet Storm, Hosting Footprint: A Mirai-Like Surge Leaves a Narrow Technical Trail
A burst of 23/TCP probing in early May 2026 shows how legacy management services and hosting-provider infrastructure can become part of the same threat picture, without proving a single root cause.
The CAPTCHA Trap That Hid Behind Real Websites and a Blockchain C2 Trail
A ClickFix-related campaign reportedly blended compromised business sites, fake verification prompts, and Polygon blockchain lookups to deliver a PowerShell backdoor.
When an Infostealer Comes for AI Keys, the Damage Starts on the Endpoint
A Windows malware family called Remus is reported to be collecting AI API tokens, passwords, wallet files, and other local secrets, showing how one infected laptop can turn into a chain reaction across cloud and crypto accounts.
When a Browser Becomes the Vault: Remus and the New Theft Economy Around AI Logins
A Windows infostealer called Remus points to a wider problem: browser-held passwords, 2FA material, and session data can turn AI tools, crypto wallets, and ordinary accounts into one shared target.
PhantomRaven Turns npm Installs Into a Secret-Hunting Trap
A JavaScript stealer moving through the npm ecosystem shows how package trust, install-time code, and AI-shaped tradecraft can collide inside ordinary developer workflows.
When Pirated Torrents Meet Blockchain Control, the Malware Gets Harder to Pin Down
MovieReaper is a Windows malware framework that blends torrent distribution, anti-analysis tricks, and Solana-based command discovery to make cleanup more difficult.
RatHat and the Android Trust Trap: When Install Prompts Become the Attack Surface
A reported Android malware campaign pushes users into sideloading disguised apps, then leans on legitimate phone features that can turn a normal device into a credential-capture tool.
The Browser Was the Beachhead: How a Malicious Extension Can Look Legitimate
A banking malware cluster is reported to have pushed malicious Chrome and Edge extensions past Chromium’s trust checks, turning the browser itself into the attack surface.
Inside the ISO Trap: How PAPERMILL Turns a Windows Attachment Into VenomRAT
A phishing chain built around disk images, trusted executables, and loader tricks shows how attackers can weaken Windows file provenance before malware ever reaches the desktop.
Thousands of Ruby Gems, One Registry, and a Very Modern Abuse Pattern
A large GemStuffer package cluster shows how open source registries can be pushed into data collection and workflow abuse, while the OpenAI connection remains an attribution question, not a confirmed root cause.
The Hidden Broker: Why a New Malware Family Chose MQTT as Its Nervous System
BambooToken turns a routine messaging protocol into a cross-platform control channel, showing how ordinary infrastructure can become a stealth layer for malware.
MQTT at the Center: BambooToken Shows How Ordinary Messaging Can Carry Malicious Control
A newly disclosed malware family uses a brokered publish/subscribe protocol to manage Windows and Linux hosts, underscoring how everyday telemetry plumbing can become a covert command layer.
Windows’ Old Script Door Is Back in the Crosshairs
A phishing operation is abusing mshta.exe, the built-in Windows HTML Application launcher, to execute malicious HTA files, inspect victim systems, and potentially reach for credentials or local secrets.
Telnet, Tiny Tooling, and a New IoT Botnet Playbook
KATARU shows how a weak remote-login service and a compact Linux utility set can turn exposed devices into candidates for root-seeking malware and DDoS abuse.
SloppyRAT Builds the Quiet Path for a Ransomware-Style Break-In
A Windows RAT delivered through a multi-stage ClickFix chain is described as a tool for reconnaissance, covert execution, and network movement before any obvious damage appears.
SloppyRAT Adds a Quiet Layer Before Ransomware Strikes
A newly identified remote access trojan, a multi-stage ClickFix chain, and blockchain-based control suggest a malware path built for persistence and stealth, not just immediate disruption.
Android Ransomware Turns Phones Into Silent Fraud Tools
Mantax OTAX is described as a mixed Android threat that combines file encryption, spyware, credential theft, and remote control in one package.
Gigabud’s Quiet Trick: Turning Android’s Work Profile Into a Hiding Place
A mobile banking malware case shows how legitimate profile isolation can be repurposed for concealment, app cloning, and checks that may fail when the device looks normal from the outside.