SIGNALMONK
Experto en seguridad inalámbrica y RFID
Perfil profesional
SignalMonk lidera operaciones de seguridad en Wi-Fi, BLE, RFID e IoT inalámbrico.
Competencias clave
Sniffing inalámbrico; explotación BLE; detección de clonación RFID; comunicación segura en IoT; forense de radio
Logros principales
Descubrió un robo corporativo mediante credenciales clonadas.
Artículos de SIGNALMONK
TrapDoor Shows How One Malicious Release Can Cross Three Language Ecosystems
A coordinated package campaign tied to npm, PyPI, and Crates.io highlights how ordinary dependency installs can become a path to credential theft.
When a Package Looks Harmless, the Install Step Can Be the Trap
A disguised Linux payload buried in package metadata shows how software installation itself can become the attack surface, not just the code that runs afterward.
When Search Becomes the Installer: The New Trap for AI Developers
A reported SEO-poisoning campaign impersonating Gemini CLI and Claude Code shows how a familiar “copy the command” workflow can become a malware delivery path.
Android’s Ad-Fraud Ghost Network: How Fake Clicks Scale Through Apps and Rotating Control Domains
A campaign tied to hundreds of Android apps shows how ad fraud can become an infrastructure problem, blending mobile distribution, automation, and evasive command channels.
When a Phone System Becomes a Foothold: The FreePBX Fraud Playbook
A FreePBX-targeting campaign shows how a web-based PBX admin panel can shift from routine management to a long-lived platform for toll fraud and abuse.
When a Workflow Becomes the Weapon: The GitHub CI Poisoning Campaign Hiding in Plain Sight
An automated burst of malicious commits across thousands of repositories shows how quickly CI/CD trust can be repurposed into a secret-hunting attack surface.
When Telecom Racks Become the Relay: The Quiet Power Behind C2 Operations
A reported wave of abuse against Middle East telecom and hosting infrastructure shows why defenders are shifting from chasing single indicators to mapping the infrastructure patterns that keep command-and-control online.
When an Invoice Becomes the Payload: Brazil’s NF-e Lure and the Banana RAT Trail
A routine electronic invoice can look harmless on its face, which is exactly why criminal groups keep turning trusted business paperwork into a malware delivery channel.
The Build Pipeline Became the Target: What a Hijacked npm Maintainer Can Really Do
A compromised package publisher in the JavaScript ecosystem can turn routine installs into a path for secret theft, with CI/CD systems bearing the highest risk.
npm Cuts Off a High-Risk Token Class as Supply-Chain Pressure Hits JavaScript Publishing
A registry-level token reset shows how quickly package security can shift when long-lived publish secrets become a target.
Operation Dragon Whistle Turns Windows Shortcuts Into a Quiet Delivery Trap
A phishing campaign built around malicious LNK files shows how ordinary Windows artifacts and trusted services can be stitched into a stealthier intrusion path.
npm Package Linked to a Second Stage on Hugging Face Raises the Supply-Chain Stakes
A reported malicious npm package, terminal-logger-utils, is described as a dropper that fetches a second-stage Node.js payload and targets developer secrets such as SSH keys, Telegram sessions, wallets, and environment variables.
When Package Trust Becomes a Delivery Channel, the Build Never Stays Clean
A suspected npm supply-chain campaign tied to a malicious package and public artifact hosting shows how modern software can be reached through the dependency graph rather than the front door.
Automation Is Eating the Web: Thales Puts Malicious Bots at 40% of Requests
A new bot report points to a web economy where machine traffic is no longer background noise, but a major part of the attack surface.
Fake Utilities, Real Theft: How TamperedChef Turns Software Trust Against Users
A malvertising campaign built around lookalike productivity apps shows how easily a polished download page can become a delivery system for stealers.
The Quiet Cloud Entry That Can Sit for Months
Exposed Redis is not just a misconfiguration problem; in Kubernetes environments it can become a durable foothold for botnet activity that is hard to spot and harder to evict.
TamperedChef Shows How “Helpful” Software Can Become the First Malware Stage
Trojanized productivity tools, stealer payloads, and RATs are a reminder that the most dangerous download can look like the most ordinary one.
Gremlin Stealer’s New Trick: Hiding Its Nervous System Inside .NET Resources
A newly identified Gremlin Stealer variant is using encrypted .NET resource sections to conceal command infrastructure and theft logic, a move that pushes malware analysis away from simple string hunting and toward runtime inspection.
When Trust Becomes a Service: The Malware-Signing Pipeline Behind Fox Tempest
A signing workflow meant to validate software became a criminal trust broker, showing how valid certificates can be turned into a delivery tool for malware and ransomware.
When a Shared Inbox Becomes a War Room: GraphWorm’s Quiet Cloud Trick
A malware campaign tied to Webworm shows how a trusted Microsoft cloud service can be repurposed as a low-noise control channel, forcing defenders to watch identity and file activity as closely as network traffic.