SIGNALMONK
Wireless & RFID Security Expert
Professional Profile
SignalMonk leads security operations on Wi-Fi, BLE, RFID, and wireless IoT.
Key Skills
Wireless sniffing; BLE exploitation; RFID cloning detection; Secure IoT communication; Radio forensics
Major Achievements
Uncovered a corporate theft via cloned badges.
Articles by SIGNALMONK
Windows’ Built-In Tools Become the Cover for a Quiet Document Hunter
TASK#STOMP shows how ordinary admin features like PowerShell and Task Scheduler can be combined into a durable backdoor that keeps access alive while files are quietly collected.
Windows Tools, Hidden Hands: TASK#STOMP and the Abuse of Trusted Admin Features
TASK#STOMP is a Windows backdoor that blends PowerShell, VBScript, scheduled tasks, and runtime C# compilation to keep access alive and harvest sensitive data.
Vidar’s Latest Trick: A Custom VM and Cipher Maze Built to Waste Analyst Time
The infostealer’s reported shift from simple string hiding to layered obfuscation shows how commodity malware is borrowing techniques that make reverse engineering slower and less reliable.
Fake LastPass Installers Turn a Trusted Brand Into a Kernel-Mode Blindfold
A branded installer lure, a kernel-level EDR killer, and an infostealer payload show how attackers can first erase visibility and then hunt for credentials.
When a Signed Driver Becomes the Opening Move for an Infostealer
A Windows malware campaign tracked as Rapuncel pairs brand impersonation with a Microsoft-attested kernel driver, then turns that trust into a way to shut down security tools and harvest credentials, tokens, and files.
When a Package Looks Clean and Still Turns Risky at Runtime
A lookalike npm package named indexed-btree is described as hiding malicious behavior in ordinary JavaScript code, a pattern that can slip past install-time checks and surface only when the package is actually used.
Telnet Storm, Hosting Footprint: A Mirai-Like Surge Leaves a Narrow Technical Trail
A burst of 23/TCP probing in early May 2026 shows how legacy management services and hosting-provider infrastructure can become part of the same threat picture, without proving a single root cause.
The CAPTCHA Trap That Hid Behind Real Websites and a Blockchain C2 Trail
A ClickFix-related campaign reportedly blended compromised business sites, fake verification prompts, and Polygon blockchain lookups to deliver a PowerShell backdoor.
When an Infostealer Comes for AI Keys, the Damage Starts on the Endpoint
A Windows malware family called Remus is reported to be collecting AI API tokens, passwords, wallet files, and other local secrets, showing how one infected laptop can turn into a chain reaction across cloud and crypto accounts.
When a Browser Becomes the Vault: Remus and the New Theft Economy Around AI Logins
A Windows infostealer called Remus points to a wider problem: browser-held passwords, 2FA material, and session data can turn AI tools, crypto wallets, and ordinary accounts into one shared target.
PhantomRaven Turns npm Installs Into a Secret-Hunting Trap
A JavaScript stealer moving through the npm ecosystem shows how package trust, install-time code, and AI-shaped tradecraft can collide inside ordinary developer workflows.
When Pirated Torrents Meet Blockchain Control, the Malware Gets Harder to Pin Down
MovieReaper is a Windows malware framework that blends torrent distribution, anti-analysis tricks, and Solana-based command discovery to make cleanup more difficult.
RatHat and the Android Trust Trap: When Install Prompts Become the Attack Surface
A reported Android malware campaign pushes users into sideloading disguised apps, then leans on legitimate phone features that can turn a normal device into a credential-capture tool.
The Browser Was the Beachhead: How a Malicious Extension Can Look Legitimate
A banking malware cluster is reported to have pushed malicious Chrome and Edge extensions past Chromium’s trust checks, turning the browser itself into the attack surface.
Inside the ISO Trap: How PAPERMILL Turns a Windows Attachment Into VenomRAT
A phishing chain built around disk images, trusted executables, and loader tricks shows how attackers can weaken Windows file provenance before malware ever reaches the desktop.
Thousands of Ruby Gems, One Registry, and a Very Modern Abuse Pattern
A large GemStuffer package cluster shows how open source registries can be pushed into data collection and workflow abuse, while the OpenAI connection remains an attribution question, not a confirmed root cause.
The Hidden Broker: Why a New Malware Family Chose MQTT as Its Nervous System
BambooToken turns a routine messaging protocol into a cross-platform control channel, showing how ordinary infrastructure can become a stealth layer for malware.
MQTT at the Center: BambooToken Shows How Ordinary Messaging Can Carry Malicious Control
A newly disclosed malware family uses a brokered publish/subscribe protocol to manage Windows and Linux hosts, underscoring how everyday telemetry plumbing can become a covert command layer.
Windows’ Old Script Door Is Back in the Crosshairs
A phishing operation is abusing mshta.exe, the built-in Windows HTML Application launcher, to execute malicious HTA files, inspect victim systems, and potentially reach for credentials or local secrets.
Telnet, Tiny Tooling, and a New IoT Botnet Playbook
KATARU shows how a weak remote-login service and a compact Linux utility set can turn exposed devices into candidates for root-seeking malware and DDoS abuse.