SIGNALMONK
Wireless & RFID Security Expert
Professional Profile
SignalMonk leads security operations on Wi-Fi, BLE, RFID, and wireless IoT.
Key Skills
Wireless sniffing; BLE exploitation; RFID cloning detection; Secure IoT communication; Radio forensics
Major Achievements
Uncovered a corporate theft via cloned badges.
Articles by SIGNALMONK
GitHub Becomes the Quiet Highway for a Rust Backdoor
C2Looper v2 shows how developer infrastructure can be repurposed for command-and-control without any need for custom hosting.
Backdoor C2Looper Turns Legitimate Platforms Into a Stealthy Control Channel
C2Looper is a July 2026 backdoor that researchers link, with caution, to ransomware-related activity and to a delivery path that may involve ClickFix chains.
Android’s Newest Fraud Machine Puts Banking Apps on the Screen and the Attacker in the Chair
Octagon is described as an Android malware platform built for wallet and banking abuse, combining accessibility tricks, overlays, and hidden remote control in a way that fits modern live-fraud tradecraft.
ChainDrop and the New npm Trust Problem
A self-propagating npm worm reportedly spread without stealing a long-lived publishing token, pushing defenders to think about identity and workflow trust, not just secret theft.
Perimeter Machines Become Pirate Ports in a New Linux Botnet Wave
A newly identified Linux botnet is turning routers, firewalls, cameras, and other internet-facing gear into traffic relays, DDoS nodes, and possible credential-harvesting footholds.
Mac Browser Control Goes Live: Why AmnesiaStealer Changes the Shape of Session Theft
A newly identified macOS infostealer uses a ClickFix-style lure and a streaming module that can let an operator interact with the victim’s browser in real time.
When Malware Moves Onto the Chain, the Old Takedown Playbook Starts to Fray
Aeternum is reported to use Polygon smart contracts as its control channel, a design that shifts botnet coordination away from disposable servers and toward infrastructure that is harder to remove.
Suspected APT36 Cluster Raises the Possibility of LLM-Assisted Malware Craft
A newly observed set of custom malware families may show signs of AI-assisted development, while attribution to APT36 remains moderate-confidence rather than definitive.
Fake GitHub Pages, Real Browser Theft: How a New macOS Infostealer Turns Trust Into Access
AmnesiaStealer is being described as a macOS infostealer delivered through ClickFix-style lures, a reminder that on modern desktops the weakest link is often the person clicking the page.
When Malware Talks on Chain, Takedowns Lose Their Edge
Aeternum illustrates a quieter shift in botnet design: moving command traffic onto a public blockchain where ordinary server seizures matter less.
Android Malware Turns NFC Into a Fraud Tool, With Loans and Cash-Outs in the Same Chain
Researchers are tracking a financial-fraud workflow that mixes vishing, malicious Android apps, and NFC abuse to push losses from the screen to the checkout counter and, in some cases, to cash withdrawals.
Fake Setup Files Turn Trusted Windows Downloads Into Malware Lures
A counterfeit CCleaner installer tied to GhostDesk is a reminder that the weakest link is often the moment a user clicks "run."
Inside the Stealer Kit Hiding in Plain Sight
A reported .NET infostealer chain uses PNG concealment and PowerShell-driven injection, a mix that can blur file-based detection while reaching for browser secrets, wallets, and local data.
When a Trojan Learns Your Browser, It Stops Being Just Malware
Abyssos is described as a post-compromise RAT that combines credential theft, browser-session hijacking, and hidden remote-control access into one operator-friendly toolkit.
Inside the Windows Trojan Built to Leave Almost No Static Footprints
A compact x64 RAT called CNCMachineRMS shows how modern malware is trading obvious imports for runtime lookup, forcing defenders to watch behavior instead of file labels.
Fake VPN Tests Are Becoming a Quiet Windows Delivery Trick
A recruitment-style lure that looks like routine onboarding can push a Windows machine into creating a scheduled task and fetching malware, turning hiring workflows into an attack surface.
When a Website, a Browser Prompt, and a Blockchain Join the Same Malware Supply Chain
ErrTraffic appears to combine compromised WordPress pages, ClickFix-style social engineering, rotating delivery domains, and Polygon smart contracts into a layered route for Windows malware.
Android Banking Droppers Are Changing the Game Before the Payload Even Lands
A packaging shift in Android malware is making store review and basic scanning less useful, while vendor telemetry points to fewer blocked mobile attacks in Q2 than in Q1.
Trusted Editor, Untrusted Code: How a Fake VS Code Plugin Can Hand Off to Python
A Solidity-branded extension campaign aimed at cryptocurrency developers shows how an IDE can become a staging point for code that escapes the extension runtime and runs as a separate process.
When AI Suggests the Wrong Name, npm Becomes the Battlefield
A rapid flood of suspicious packages in npm shows how registry naming, AI-generated suggestions, and trust in dependencies can collide into a supply-chain problem.