SIGNALMONK
خبير أمن اللاسلكي وRFID
الملف المهني
يقود SignalMonk العمليات الأمنية على Wi‑Fi وBLE وRFID وإنترنت الأشياء اللاسلكي.
المهارات الأساسية
التنصت على اللاسلكي؛ استغلال BLE؛ كشف استنساخ RFID؛ اتصالات IoT آمنة؛ التحليل الجنائي اللاسلكي
أبرز الإنجازات
كشف سرقة مؤسسية عبر بطاقات دخول مستنسخة.
مقالات بقلم SIGNALMONK
Mac Browser Control Goes Live: Why AmnesiaStealer Changes the Shape of Session Theft
A newly identified macOS infostealer uses a ClickFix-style lure and a streaming module that can let an operator interact with the victim’s browser in real time.
When Malware Moves Onto the Chain, the Old Takedown Playbook Starts to Fray
Aeternum is reported to use Polygon smart contracts as its control channel, a design that shifts botnet coordination away from disposable servers and toward infrastructure that is harder to remove.
Suspected APT36 Cluster Raises the Possibility of LLM-Assisted Malware Craft
A newly observed set of custom malware families may show signs of AI-assisted development, while attribution to APT36 remains moderate-confidence rather than definitive.
Fake GitHub Pages, Real Browser Theft: How a New macOS Infostealer Turns Trust Into Access
AmnesiaStealer is being described as a macOS infostealer delivered through ClickFix-style lures, a reminder that on modern desktops the weakest link is often the person clicking the page.
When Malware Talks on Chain, Takedowns Lose Their Edge
Aeternum illustrates a quieter shift in botnet design: moving command traffic onto a public blockchain where ordinary server seizures matter less.
Android Malware Turns NFC Into a Fraud Tool, With Loans and Cash-Outs in the Same Chain
Researchers are tracking a financial-fraud workflow that mixes vishing, malicious Android apps, and NFC abuse to push losses from the screen to the checkout counter and, in some cases, to cash withdrawals.
Fake Setup Files Turn Trusted Windows Downloads Into Malware Lures
A counterfeit CCleaner installer tied to GhostDesk is a reminder that the weakest link is often the moment a user clicks "run."
Inside the Stealer Kit Hiding in Plain Sight
A reported .NET infostealer chain uses PNG concealment and PowerShell-driven injection, a mix that can blur file-based detection while reaching for browser secrets, wallets, and local data.
When a Trojan Learns Your Browser, It Stops Being Just Malware
Abyssos is described as a post-compromise RAT that combines credential theft, browser-session hijacking, and hidden remote-control access into one operator-friendly toolkit.
Inside the Windows Trojan Built to Leave Almost No Static Footprints
A compact x64 RAT called CNCMachineRMS shows how modern malware is trading obvious imports for runtime lookup, forcing defenders to watch behavior instead of file labels.
Fake VPN Tests Are Becoming a Quiet Windows Delivery Trick
A recruitment-style lure that looks like routine onboarding can push a Windows machine into creating a scheduled task and fetching malware, turning hiring workflows into an attack surface.
When a Website, a Browser Prompt, and a Blockchain Join the Same Malware Supply Chain
ErrTraffic appears to combine compromised WordPress pages, ClickFix-style social engineering, rotating delivery domains, and Polygon smart contracts into a layered route for Windows malware.
Android Banking Droppers Are Changing the Game Before the Payload Even Lands
A packaging shift in Android malware is making store review and basic scanning less useful, while vendor telemetry points to fewer blocked mobile attacks in Q2 than in Q1.
Trusted Editor, Untrusted Code: How a Fake VS Code Plugin Can Hand Off to Python
A Solidity-branded extension campaign aimed at cryptocurrency developers shows how an IDE can become a staging point for code that escapes the extension runtime and runs as a separate process.
When AI Suggests the Wrong Name, npm Becomes the Battlefield
A rapid flood of suspicious packages in npm shows how registry naming, AI-generated suggestions, and trust in dependencies can collide into a supply-chain problem.
When a Package Maintainer Becomes the Weakest Link: The Shai-Hulud npm Warning
A self-propagating npm campaign aimed at developer credentials shows how one publishing account can become a distribution path for supply-chain malware.
Inside the Python Stealer Built to Hide in Plain Sight
Vanta Stealer shows how packaging and obfuscation can turn familiar developer tools into a concealment layer for credential theft, token abuse, and wallet scraping.
Ethereum Used as a Malware Lookup Layer in a Remus Campaign
A reported infostealer operation is leaning on a smart contract to redirect victims toward changing command-and-control infrastructure, showing how public blockchain tools can be repurposed for resilience.
When the Browser Becomes the Bait: A Mac ClickFix Campaign Hides in Plain Sight
A social-engineering chain aimed at selected Mac users pairs fake download pages with browser fingerprinting and Terminal-pasted commands, with Atomic Stealer as the suspected endgame.
Remus Steals the Easy Way In, Then Hides Its Command Server in Ethereum
A new malware campaign uses SEO-poisoned cracked-software lures and an Ethereum smart contract to conceal its command server while stealing browser and account data.