SIGNALMONK
Experto en seguridad inalámbrica y RFID
Perfil profesional
SignalMonk lidera operaciones de seguridad en Wi-Fi, BLE, RFID e IoT inalámbrico.
Competencias clave
Sniffing inalámbrico; explotación BLE; detección de clonación RFID; comunicación segura en IoT; forense de radio
Logros principales
Descubrió un robo corporativo mediante credenciales clonadas.
Artículos de SIGNALMONK
When the PoC Is the Payload: A GitHub Trap Built for Security Hunters
A reported campaign called ChocoPoC turns the normal rush for fresh exploit code into an infection path, using fake GitHub PoC repositories to deliver a Python RAT and target browser-stored secrets.
When a Web Server Becomes a Hidden Foothold
An incident response investigation found an attack chain built on disabled defenses, a steganographic web shell, and Mimikatz, then repeated reuse of a server that had not been fully cleaned.
One Stealer IP, a Hidden Maritime Scam Grid
A single RedLine-linked host became the starting point for mapping infrastructure that appears designed for maritime-themed spear phishing and BEC support.
When a Signed Driver Turns Into a Blindfold for EDR
Ransomware operators are leaning on vulnerable Windows kernel drivers to weaken endpoint defenses before encryption starts, and the trust model itself is part of the problem.
Fake Perplexity Extension Turned Chrome Searches Into a Quiet Target
A lookalike browser add-on used a trusted AI brand to win installs, showing how extension permissions can turn ordinary searches into sensitive telemetry.
SimpleHelp Login Trust Broken, Malware Chain Follows
A critical authentication bypass in SimpleHelp’s OIDC flow may have let attackers obtain technician access and deliver two malware families, turning a remote support tool into a high-risk entry point.
The DLL That Wore a Security Badge: Mistic’s Quiet Path Into Windows
A new Windows backdoor is reportedly hiding behind a Microsoft-style component name, using DLL sideloading and self-cleaning behavior to make incident response harder.
Millenium RAT’s Windows Push Points to a Cleaner, Harder-to-Hunt Malware Model
Group-IB’s analysis of Millenium RAT v4.* ties 62,289 Windows infections in more than 160 countries to Telegram bot communication, a combination that can blur malicious traffic inside ordinary cloud use.
Package Trust Under Siege: Miasma’s Latest Move Cuts Across npm, GitHub Actions, and Go
The latest Miasma-linked supply-chain activity shows how a single poisoned release can pressure multiple trust layers at once, from package registries to build automation.
Trusted npm Packages Become the Doorway in a Quiet Secret-Harvesting Campaign
A poisoned-package wave tied to Mini Shai-Hulud, Miasma, and Hades is pushing supply-chain risk into the heart of developer workstations and CI/CD pipelines.
LokiBot’s New Cover Story: Hashes, Legacy Crypto, and a Harder Target for Analysts
A new loader variant shows LokiBot using API hashing and 3DES-encrypted C2 configuration to make static analysis harder.
Old Malware, New Script Chain: Why LokiBot Still Fits Modern Windows Defense Gaps
A recent LokiBot campaign pairs obfuscated JScript with PowerShell, showing how native Windows scripting can still carry commodity credential theft past noisy perimeter controls.
SharkLoader Turns Trusted Windows Paths into a Quiet Launchpad
A newly named loader linked to the StrikeShark cluster shows how public-facing application exposure, DLL side-loading, and in-memory staging can turn a routine foothold into a much harder problem.
ClawHub Malicious Skills Deliver macOS Infostealers Through Base64 curl-pipe-bash Droppers
CyberPress reports that malicious skills in ClawHub are being used to deliver macOS infostealers via Base64-encoded curl-pipe-bash droppers.
SharkLoader Turns a Diplomatic Intrusion Into a Broader Beacon Problem
A newly named loader family linked to StrikeShark shows how a small foothold can become a wider intrusion chain when the real goal is to stage Cobalt Strike Beacon.
When Crimeware Loses Its Nervous System, the Hustle Slows Down
A coordinated disruption of infrastructure linked to Amadey and StealC shows why takedowns aimed at command channels can matter even when infected machines are still out there.
Why a Quiet Backdoor Matters More Than a Loud Ransom Note
Mistic looks less like a headline-grabbing smash-and-grab and more like the kind of foothold that can be traded, reused, or handed off inside the ransomware economy.
Fake Outlook Page, Real Endpoint Risk: The Browser Backdoor Playbook Behind Edgecution
A lookalike update portal and a malicious Edge extension show how a browser lure can turn into a path toward local process control when native messaging is in play.
When a RAR File Becomes a Delivery System for Windows Persistence
A targeted campaign tied to Ukraine’s UAV ecosystem shows how a booby-trapped archive, a script loader, and a decoy document can turn routine file handling into a foothold.
When a Mac App Becomes a Moving Target: The FlutterShell Case
A macOS malware family linked to remote JavaScript delivery shows how attackers can shift meaningful logic off the binary and into infrastructure that can change at any time.