SIGNALMONK
Experto en seguridad inalámbrica y RFID
Perfil profesional
SignalMonk lidera operaciones de seguridad en Wi-Fi, BLE, RFID e IoT inalámbrico.
Competencias clave
Sniffing inalámbrico; explotación BLE; detección de clonación RFID; comunicación segura en IoT; forense de radio
Logros principales
Descubrió un robo corporativo mediante credenciales clonadas.
Artículos de SIGNALMONK
When a Shared Inbox Becomes a War Room: GraphWorm’s Quiet Cloud Trick
A malware campaign tied to Webworm shows how a trusted Microsoft cloud service can be repurposed as a low-noise control channel, forcing defenders to watch identity and file activity as closely as network traffic.
When a Tap Becomes a Trap: Android Malware and the Quiet Power of NFC Relay
A newly identified Android malware family, tied to NFC relay abuse and kiosk-style confinement, shows how contactless trust can be bent without breaking the protocol.
The One-Letter Package That Turned Dependency Trust Into a Trap
A near-identical Go module name shows how typos in dependency resolution can turn routine builds into a supply-chain risk, with DNS reportedly used as part of the payload’s control path.
Chrome’s Protected Memory Isn’t the Finish Line for Infostealers
VoidStealer is a reminder that browser hardening can still be undercut when malware waits for secrets to appear in memory, where encryption no longer helps.
Fake Updates, Real Persistence: The macOS Stealer Hiding Behind Google’s Name
A newly identified SHub Stealer variant called Reaper shows how brand spoofing and deceptive installers can turn a normal-looking update prompt into a long-lived macOS foothold.
When Chat Apps Meet Windows Utilities, Malware Gets Harder to Spot
A reported campaign tied to UAC-0184 shows how message-based lures, bitsadmin, and HTA files can form a low-noise attack chain on Windows endpoints.
When a Loader Hides in Plain Sight, the Clipboard Becomes the Target
A reported CountLoader campaign shows how Windows-native scripts, staged execution, and memory-resident payloads can turn a routine infection path into a theft mechanism aimed at crypto users.
Leaked Worm Code Turns npm Into a Faster Malware Conveyor Belt
A new round of malicious package uploads shows how a public code leak can shorten the path from research-grade malware to copycat supply-chain abuse.
Gremlin Stealer Turns .NET Resources Into a Hiding Place
A new Gremlin Stealer variant appears to tuck malicious payload material into .NET resources, a move that can make static inspection less effective while the infostealer hunts for cookies, tokens, cards, and wallet data.
Typos, Trust, and a Hidden Payload: npm’s Latest Malicious Package Trap
Four suspicious npm packages highlight how a single dependency mistake can turn routine installs into credential theft and possible denial-of-service abuse.
When an Image Becomes a Courier: The Stealth Chain Behind PawsRunner and PureLogs
A phishing-led delivery chain is using hidden data in media files to move a credential stealer into memory, showing how ordinary formats can be repurposed as covert transport.
OtterCookie Finds the Soft Spot: Developer Machines Become Live Credential Targets
A Node.js remote-access trojan is being examined as a real-time secret harvester, a reminder that one infected workstation can put source control, cloud access, and automation accounts at risk.
Gremlin Stealer and the Quiet Abuse of .NET Resource Files
A stealer malware family is being linked to a familiar but easily abused .NET feature, showing how ordinary packaging mechanisms can become a hiding place for payloads.
Shai-Hulud’s Code Has Found New Hands, and npm Is the Battlefield
A recently released malware codebase has reportedly been reused in attacks tied to the npm ecosystem, raising the odds that one worm can quickly become many variants.
Linux’s Quiet Credential Thief: Why a Recycled Rootkit Matters
OrBit is being described as a Linux rootkit used to harvest SSH and sudo credentials, with recent analysis framing it as a selectively weaponized clone of Medusa rather than a fresh invention.
When a Popular Node.js Helper Turned Into a Supply-Chain Trap
A widely downloaded npm package was flagged with malicious releases, showing how one poisoned dependency can turn routine imports into a credential risk.
The Malware That Watches Back: Screen Control, Browser Snooping, and a Windows Privilege Jump
A Windows malware framework reported with screen control, browser artifact access, and a UAC bypass highlights how one post-compromise tool can stretch from observation to elevation.
When Code Keeps Changing, Security Has to Change Faster
In a post-quantum security context, polymorphic malware adds another layer of defensive complexity, pushing defenders to look beyond cryptographic theory and into implementation, identity, and operational control.
When a Home Laptop Becomes the Key to Corporate Systems
Infostealer malware on personal devices is less about nuisance and more about identity theft: browser cookies, VPN logins, and cloud tokens can be reused against business systems later.
Fake Claude Code Installers Turn a Developer Shortcut Into a Credential Trap
A counterfeit installer aimed at developers highlights how trusted setup habits can be repurposed into browser password and cookie theft.