SIGNALMONK
Experto en seguridad inalámbrica y RFID
Perfil profesional
SignalMonk lidera operaciones de seguridad en Wi-Fi, BLE, RFID e IoT inalámbrico.
Competencias clave
Sniffing inalámbrico; explotación BLE; detección de clonación RFID; comunicación segura en IoT; forense de radio
Logros principales
Descubrió un robo corporativo mediante credenciales clonadas.
Artículos de SIGNALMONK
BINDCLOAK Turns Windows Tokens Into a Stealth Tool
A modular backdoor linked to a multi-stage intrusion chain shows how memory-only execution and token abuse can make a Windows campaign harder to spot and harder to unwind.
Fake AI Tools, Real Theft: npm Packages Turned Developer Trust Into a Secret Harvest
A malicious npm campaign disguised as internal AI and developer tooling targeted developers linked to Alibaba Group, using layered packages to steal credentials, cloud API keys, and enterprise data.
BTMOB’s Real Product Was Not Malware Alone, But a Market
Thousands of underground posts point to an Android RAT whose bigger innovation may be its business model: a fragmented ecosystem of resellers, code vendors, custom builds, and rival sales channels.
MacSync and the New Mac Trap: When a Fake Prompt Becomes a Password Vault Raid
A newly documented macOS threat shows how social engineering, browser-session theft, and Keychain harvesting can turn one user interaction into a much wider credential crisis.
Hijacked WhatsApp Accounts Are Becoming Malware Delivery Lines
A banking trojan tied to Astaroth, also known as Guildma, is using compromised WhatsApp identities and ZIP attachments to reach trusted contacts in Brazil.
AtlasRAT and the Quiet War for the Windows Desktop
A modular Windows RAT is being described with a four-stage in-memory chain, encrypted command traffic, offline keylogging, and DLL injection into WeChat - a blend built to stay hard to see and harder to dissect.
When Linux Login Plumbing Becomes a Miner's Hideout
A May 2026 cryptomining campaign linked to XMRig used Linux PAM as a persistence layer, showing how attackers can turn the authentication stack into a quiet place to stay.
The CAPTCHA Trap on Mac: How a Browser Check Can Become a Shell Command
Attackers are using fake CAPTCHAs to trick macOS users into running malicious commands, in a campaign that reportedly deploys AMOS and targets browser credentials and crypto wallets.
A Trusted npm Path Became a Malware Delivery Lane
A reported Joyfill package compromise shows how a single dependency can turn into a remote-control foothold and a secret-harvesting trap.
When a Fake Official App Becomes a Remote Control Panel
Flying Eagle shows how Android accessibility can be twisted into a spyware toolkit when a convincing government-themed lure gets a user to install the wrong app.
When a Package Install Turns into a Hidden Control Channel
A reported npm supply-chain operation shows how transitive dependencies can turn a routine developer install into a cross-platform remote access risk.
Trusted npm Names, Poisoned Builds: The AsyncAPI Package Incident Exposes a Quiet Supply-Chain Trap
Malicious releases in the AsyncAPI ecosystem highlight how a single dependency can put developer tokens, cloud keys, and CI/CD secrets within reach of build-time code.
When Killing the Bot Makes Things Worse: Tengu’s Reboot Loop for Linux Devices
A Mirai-lineage botnet is turning a built-in safety feature into an anti-remediation trick, showing how exposed Linux appliances can be harder to clean than they look.
Tengu’s Quiet Trick: A Mirai Offshoot That Fights the Reboot Button
This Linux botnet blends DDoS muscle with persistence and watchdog abuse, turning basic cleanup steps into a harder technical problem.
The Windows Shadow Market Behind Cruciferra
A crypter called Cruciferra sits at the junction of malware packing, vulnerable-driver abuse, and process ghosting, showing how Windows stealth can be layered rather than improvised.
TrickBot’s Quiet Channel: DNS Tunneling Turns Routine Traffic into a Cover Story
A reported TrickBot variant is using DNS tunneling for command-and-control, a reminder that the most ordinary network services can become the hardest to watch.
Golden Chickens Returns with a Sharper, More Modular Browser Theft Kit
The long-running MaaS ecosystem appears to be refining its playbook around lightweight access, modular implants, and browser-focused theft, a combination that can complicate detection and response.
Golden Chickens Bets on Smaller Malware Pieces to Chase Browser Secrets
The group known as Golden Chickens is being tied to four modular malware families, a design shift that matters because browser theft is increasingly about live sessions, not just saved passwords.
The Fake Plugin Trick Turning a Text Editor into a Malware Disguise
A malicious add-on dressed as a Notepad++ plugin shows how attackers can weaponize trusted extension workflows on Windows without needing a flashy exploit.
TrickBot’s New Whisper Channel: DNS Turns a Familiar Malware Family Harder to See
A TrickBot variant is described using DNS tunneling for command-and-control, a shift that changes which logs defenders need to trust first.