SIGNALMONK
خبير أمن اللاسلكي وRFID
الملف المهني
يقود SignalMonk العمليات الأمنية على Wi‑Fi وBLE وRFID وإنترنت الأشياء اللاسلكي.
المهارات الأساسية
التنصت على اللاسلكي؛ استغلال BLE؛ كشف استنساخ RFID؛ اتصالات IoT آمنة؛ التحليل الجنائي اللاسلكي
أبرز الإنجازات
كشف سرقة مؤسسية عبر بطاقات دخول مستنسخة.
مقالات بقلم SIGNALMONK
The npm Package That Became a Worm Carrier
A developer tool with heavy weekly usage was turned into a supply-chain infection path, showing how install-time behavior can matter as much as runtime code.
How a Browser Add-on Became the Front Door for Wallet and Credential Theft
A cluster of malicious Chrome and Edge extensions shows how ordinary browser permissions can turn trusted add-ons into a quiet risk for logins and crypto activity.
When a CAPTCHA Becomes a Shell: The TerminalFix Playbook for Turning Trust Into Access
A fake verification page can do more than annoy users - in ClickFix-style campaigns, it can become the first step in a multi-stage intrusion chain that ends with a reverse-tunnel foothold.
When a Build Tool Turns Hostile: The npm Package That Put Developer Trust on the Line
A popular OpenAPI-to-TanStack Query generator was linked to a burst of malicious releases, raising a familiar but uncomfortable question: what happens when the tool chain itself becomes the threat surface?
Ten Minutes, Ten Bad Releases: How a Build Tool Became the Weakest Link
A reported malicious npm release campaign against a popular OpenAPI-to-TanStack Query code generator highlights how build-time developer tools can become high-value supply-chain targets.
Tax Lures, Modular Malware, and the Quiet Return of Packaged Access
A phishing chain tied to the cluster tracked as TA4922 shows how tax-themed email can be turned into a delivery path for a modular RAT, staged loaders, and follow-on access tooling.
When a CAPTCHA Becomes a Trap Door: Fake Verification Pages and the PowerShell Pivot
A disguised human-check page can push a browser session into terminal execution, turning ordinary Windows endpoints into reverse-tunnel footholds for attackers.
Tax Notices, Telegram Sales, and a Modular RAT: The Quiet Machinery Behind a Phishing Run
A tax-themed lure linked to TA4922 shows how localized phishing and commodity malware can be fused into a repeatable access playbook without proving full compromise.
The Resume Trap That Can Turn Research Inboxes Into Malware Runways
A credential-flavored archive can look ordinary for one second and hostile the next, especially when it hides a disguised executable linked to the SNOWLIGHT and VShell malware stack.
When a WordPress Plugin Starts Talking to the Browser
A reported campaign links auto-loading WordPress code, a malicious Service Worker, and layered delivery tricks into a web attack path built for stealth and resilience.
Fake CAPTCHA, Real Theft: How Hijacked WordPress Pages Became Windows Credential Traps
A campaign abusing compromised WordPress sites shows how a trusted webpage can be turned into a delivery layer for infostealer malware without a classic exploit chain.
When Malware Finds a Shortcut Through Ethereum
GoCaracal pairs interactive post-compromise features with a blockchain-based lookup for a replacement command address, making takedown work harder for defenders.
Spark RAT in Cambodia: When a Familiar Trap Meets a Weakened Defense Layer
A malware campaign aimed at Cambodian users and organizations combines social engineering with a vulnerable driver to make endpoint protection harder to trust.
SLEEPWALKER Turns Routine Windows Paths Into a Stealth Channel
A newly described Windows backdoor is notable less for flashy payloads than for how it can move operator commands through DNS, ICMP, SMB named pipes, raw packets, and VMware VMCI.
SLEEPWALKER Turns a Single Packet Into a Wake-Up Call for Defenders
A new Windows backdoor pairs packet-gated activation with a custom bytecode layer, a combination that can complicate both detection and reverse engineering.
When Malware Starts Looking Like a Word Puzzle, Windows Users Lose the Easy Clue
A ClearFake-linked delivery chain is using plain English words to hide shellcode, a reminder that modern stealers often win by looking boring until the last possible moment.
Botnet C2 Gets an AI Middleman: Why ToxNetV2 Matters
A Linux peer-to-peer botnet is described as routing telemetry through an NVIDIA NIM-backed workflow, turning raw system data into structured action records instead of relying on manual operator triage.
PavinLoader Turns Verification Theater into a Stealer Delivery Chain
A .NET malware loader is being linked to ClickFix lures, fake download prompts, and malicious game campaigns, with blockchain-based C2 adding resilience to the campaign.
Lookalike Minecraft Sites Keep Feeding WeedHack After the Knockout Blow
The campaign’s original command layer was disrupted, but SEO-poisoned impersonation pages are still pushing malicious Minecraft clients and mods into search results.
Two New Malware Loaders Target Windows Credentials
WordlistLoader and SynkLoader are a reminder that criminal tooling often starts small, then hands off to stealer payloads and password theft.