SIGNALMONK
Wireless & RFID Security Expert
Professional Profile
SignalMonk leads security operations on Wi-Fi, BLE, RFID, and wireless IoT.
Key Skills
Wireless sniffing; BLE exploitation; RFID cloning detection; Secure IoT communication; Radio forensics
Major Achievements
Uncovered a corporate theft via cloned badges.
Articles by SIGNALMONK
npm’s Trust Chain Turns Toxic in the MALFEX Package Cluster
A Windows-focused npm supply-chain campaign shows how a routine dependency install can become a delivery path for remote access malware and credential-stealing code.
Poem-Driven C2: The Hidden Trick Behind a New Wave of AI-Service Malware
A malware campaign called PoeLLM is using a GitHub-hosted poem to help infected servers find command-and-control infrastructure, showing how exposed AI and developer tools can be turned into a control plane.
When Malware Reads the Ledger: The New Problem of Blockchain-Powered C2
Security research points to a supply-chain tactic in which public blockchains help malware refresh its command infrastructure after it is already on a compromised system.
A Poisoned npm Release Turned a Trusted Name into a Supply-Chain Trap
A single malicious package version can become a delivery system for secret theft, credential abuse, and wider propagation risk across developer workflows.
CastleStealer’s New Trick Turns a Stealer Into a Live Intrusion Tool
A C# infostealer first seen in April 2026 is now reported to carry remote shell capability, a shift that can turn stolen data into active command execution on compromised machines.
MATCHBOIL Grows Teeth: The Malware That Learned to Hide Better
A C# downloader is not supposed to look like a hardened implant, but MATCHBOIL now carries sandbox checks, commercial .NET obfuscation, deceptive interfaces, and recurring command-and-control traffic.
When a Terraform Plugin Turns Into a Workplace Intruder
A malicious Terraform provider has reportedly been used to steal developer credentials and plant backdoors, showing how infrastructure automation can become an execution path for cross-platform compromise.
Phones That Arrive Dirty: The Hidden Risk of Malware in Android Firmware
A preloaded Android threat on low-cost handsets is a reminder that sometimes the compromise starts before the first tap, not after the first download.
Fake Verification Screens Are the New Malware Conveyor Belt
A campaign tied to more than 100 compromised websites shows how a trusted page can be turned into a command prompt for the victim's own Windows machine.
Fake Verification, Real Payload: How Compromised Sites Became Stealers’ Delivery Lines
A wave of injected JavaScript turned more than 100 websites into a trust trap, using a fake Cloudflare-style check to push LunexStealer through a user-driven execution chain.
When a Common Setup Tool Becomes Botnet Cover: Cling and the Quiet Abuse of STUN
A botnet tied to internet-exposed IoT and networking devices shows how ordinary NAT-traversal traffic can be repurposed to hide command-and-control behavior.
Linux Backdoor ClingSTUN Turns a Standard NAT Tool into a Hidden Reachability Layer
A malware family tied to abused STUN traffic and boot-time persistence shows how ordinary network plumbing can be repurposed to keep compromised Linux devices reachable.
ClingSTUN and the Quiet Theft of IoT: When Backdoors Turn Devices into Relay Infrastructure
A Linux backdoor tied to 24 IoT vulnerabilities shows how routine device exposure can be repurposed into remote access and proxy infrastructure.
The Perimeter’s Fake Face: Linux Backdoors That Pose as Mail Security Gear
Three newly identified Linux implants imitate legitimate Asian mail-security products, turning trusted-looking edge software into a camouflage layer for stealthy access.
A Fake Zoom Installer Smuggled a Universal macOS Backdoor
A counterfeit Zoom package targeting Macs carried CloudSyncD, a backdoor wrapped inside a universal Mach-O payload and extracted only when the installer ran.
When a Banking Trojan Turns Android’s Trust Features Against It
RATHat shows how a mobile trojan can chain Accessibility access, wireless debugging, and a disputed AI label into something closer to device control than simple credential theft.
Python Infostealer Hunts Browser Secrets in a Nested Archive Trap
A Windows malware sample packaged in layered archives is reported to target passwords, cookies, card data, and session tokens across 17 browsers, turning everyday browser storage into a high-value target.
RATHat Turns Android’s Trusted Controls Into a Criminal Workflow
A reported banking trojan pairs lure apps, background services, and abused developer features with AI-assisted operator tactics to press into Android devices.
SectopRAT’s Real Trick: Hiding Inside Familiar Software to Hunt Wallets and Browser Secrets
The danger is not a flashy zero-day here, but a quieter abuse of trust: malware tucked into legitimate software components, with browser credentials and crypto wallets in its crosshairs.
When Malware Learns to Ask for Help: Android Fraud Gets a Model-Assisted Upgrade
A newly documented Android banking trojan called RATHat is a reminder that mobile crime is starting to borrow the language of AI to move faster and look less scripted.