SIGNALMONK
Wireless & RFID Security Expert
Professional Profile
SignalMonk leads security operations on Wi-Fi, BLE, RFID, and wireless IoT.
Key Skills
Wireless sniffing; BLE exploitation; RFID cloning detection; Secure IoT communication; Radio forensics
Major Achievements
Uncovered a corporate theft via cloned badges.
Articles by SIGNALMONK
AtlasRAT and the Quiet War for the Windows Desktop
A modular Windows RAT is being described with a four-stage in-memory chain, encrypted command traffic, offline keylogging, and DLL injection into WeChat - a blend built to stay hard to see and harder to dissect.
When Linux Login Plumbing Becomes a Miner's Hideout
A May 2026 cryptomining campaign linked to XMRig used Linux PAM as a persistence layer, showing how attackers can turn the authentication stack into a quiet place to stay.
The CAPTCHA Trap on Mac: How a Browser Check Can Become a Shell Command
Attackers are using fake CAPTCHAs to trick macOS users into running malicious commands, in a campaign that reportedly deploys AMOS and targets browser credentials and crypto wallets.
A Trusted npm Path Became a Malware Delivery Lane
A reported Joyfill package compromise shows how a single dependency can turn into a remote-control foothold and a secret-harvesting trap.
When a Fake Official App Becomes a Remote Control Panel
Flying Eagle shows how Android accessibility can be twisted into a spyware toolkit when a convincing government-themed lure gets a user to install the wrong app.
When a Package Install Turns into a Hidden Control Channel
A reported npm supply-chain operation shows how transitive dependencies can turn a routine developer install into a cross-platform remote access risk.
Trusted npm Names, Poisoned Builds: The AsyncAPI Package Incident Exposes a Quiet Supply-Chain Trap
Malicious releases in the AsyncAPI ecosystem highlight how a single dependency can put developer tokens, cloud keys, and CI/CD secrets within reach of build-time code.
When Killing the Bot Makes Things Worse: Tengu’s Reboot Loop for Linux Devices
A Mirai-lineage botnet is turning a built-in safety feature into an anti-remediation trick, showing how exposed Linux appliances can be harder to clean than they look.
Tengu’s Quiet Trick: A Mirai Offshoot That Fights the Reboot Button
This Linux botnet blends DDoS muscle with persistence and watchdog abuse, turning basic cleanup steps into a harder technical problem.
The Windows Shadow Market Behind Cruciferra
A crypter called Cruciferra sits at the junction of malware packing, vulnerable-driver abuse, and process ghosting, showing how Windows stealth can be layered rather than improvised.
TrickBot’s Quiet Channel: DNS Tunneling Turns Routine Traffic into a Cover Story
A reported TrickBot variant is using DNS tunneling for command-and-control, a reminder that the most ordinary network services can become the hardest to watch.
Golden Chickens Returns with a Sharper, More Modular Browser Theft Kit
The long-running MaaS ecosystem appears to be refining its playbook around lightweight access, modular implants, and browser-focused theft, a combination that can complicate detection and response.
Golden Chickens Bets on Smaller Malware Pieces to Chase Browser Secrets
The group known as Golden Chickens is being tied to four modular malware families, a design shift that matters because browser theft is increasingly about live sessions, not just saved passwords.
The Fake Plugin Trick Turning a Text Editor into a Malware Disguise
A malicious add-on dressed as a Notepad++ plugin shows how attackers can weaponize trusted extension workflows on Windows without needing a flashy exploit.
TrickBot’s New Whisper Channel: DNS Turns a Familiar Malware Family Harder to See
A TrickBot variant is described using DNS tunneling for command-and-control, a shift that changes which logs defenders need to trust first.
Portuguese Language, Criminal Precision: Why a Brazilian Banking Trojan Fits Portugal So Well
A banking trojan moving through Portugal highlights a familiar fraud tactic: attackers often win by matching the victim's language, not just their code.
Thousands of GitHub Repos, One Familiar Trap: How FakeGit Turned Trust Into Delivery
A sprawling repository-abuse campaign linked to FakeGit used roughly 7,600 GitHub repos and more than 14 million downloads to push SmartLoader and StealC, showing how platform trust can become malware transport.
Ethereum’s Public Ledger Becomes a Hiding Place for Malware Control
A reported Amatera Stealer campaign uses Ethereum smart contracts to obscure command-and-control endpoints, showing how attackers can twist public blockchain features into infrastructure camouflage.
The Evasion Market Behind Commodity RATs Is Getting Sharper
Cruciferra is being tied to an industrial-style malware chain that pairs email lures with defense evasion, then drops familiar remote access tools onto targeted systems.
When Release Automation Turns Hostile: The AsyncAPI npm Incident and the Trust Problem Behind It
A reported package-publishing compromise in the AsyncAPI ecosystem shows how GitHub Actions, npm trust, and generator tooling can become a malware delivery path when release controls are subverted.