SIGNALMONK
Experto en seguridad inalámbrica y RFID
Perfil profesional
SignalMonk lidera operaciones de seguridad en Wi-Fi, BLE, RFID e IoT inalámbrico.
Competencias clave
Sniffing inalámbrico; explotación BLE; detección de clonación RFID; comunicación segura en IoT; forense de radio
Logros principales
Descubrió un robo corporativo mediante credenciales clonadas.
Artículos de SIGNALMONK
Phones That Arrive Dirty: The Hidden Risk of Malware in Android Firmware
A preloaded Android threat on low-cost handsets is a reminder that sometimes the compromise starts before the first tap, not after the first download.
Fake Verification Screens Are the New Malware Conveyor Belt
A campaign tied to more than 100 compromised websites shows how a trusted page can be turned into a command prompt for the victim's own Windows machine.
Fake Verification, Real Payload: How Compromised Sites Became Stealers’ Delivery Lines
A wave of injected JavaScript turned more than 100 websites into a trust trap, using a fake Cloudflare-style check to push LunexStealer through a user-driven execution chain.
When a Common Setup Tool Becomes Botnet Cover: Cling and the Quiet Abuse of STUN
A botnet tied to internet-exposed IoT and networking devices shows how ordinary NAT-traversal traffic can be repurposed to hide command-and-control behavior.
Linux Backdoor ClingSTUN Turns a Standard NAT Tool into a Hidden Reachability Layer
A malware family tied to abused STUN traffic and boot-time persistence shows how ordinary network plumbing can be repurposed to keep compromised Linux devices reachable.
ClingSTUN and the Quiet Theft of IoT: When Backdoors Turn Devices into Relay Infrastructure
A Linux backdoor tied to 24 IoT vulnerabilities shows how routine device exposure can be repurposed into remote access and proxy infrastructure.
The Perimeter’s Fake Face: Linux Backdoors That Pose as Mail Security Gear
Three newly identified Linux implants imitate legitimate Asian mail-security products, turning trusted-looking edge software into a camouflage layer for stealthy access.
A Fake Zoom Installer Smuggled a Universal macOS Backdoor
A counterfeit Zoom package targeting Macs carried CloudSyncD, a backdoor wrapped inside a universal Mach-O payload and extracted only when the installer ran.
When a Banking Trojan Turns Android’s Trust Features Against It
RATHat shows how a mobile trojan can chain Accessibility access, wireless debugging, and a disputed AI label into something closer to device control than simple credential theft.
Python Infostealer Hunts Browser Secrets in a Nested Archive Trap
A Windows malware sample packaged in layered archives is reported to target passwords, cookies, card data, and session tokens across 17 browsers, turning everyday browser storage into a high-value target.
RATHat Turns Android’s Trusted Controls Into a Criminal Workflow
A reported banking trojan pairs lure apps, background services, and abused developer features with AI-assisted operator tactics to press into Android devices.
SectopRAT’s Real Trick: Hiding Inside Familiar Software to Hunt Wallets and Browser Secrets
The danger is not a flashy zero-day here, but a quieter abuse of trust: malware tucked into legitimate software components, with browser credentials and crypto wallets in its crosshairs.
When Malware Learns to Ask for Help: Android Fraud Gets a Model-Assisted Upgrade
A newly documented Android banking trojan called RATHat is a reminder that mobile crime is starting to borrow the language of AI to move faster and look less scripted.
When a Fake Download Page Becomes an Admin Console for Malware
A Microsoft Store-style lure, abused remote management software, and a .NET RAT show how attackers can turn everyday support tooling into a covert control path.
OpenSUpdater Hides a Reflective Loader Inside a Recompiled 7-Zip SFX
A reworked self-extracting archive can keep malicious logic in the installer stub while the files that appear after extraction look ordinary.
Counterfeit Download Pages Turn a Routine Click Into a Windows Trap
A Windows malware campaign built around fake software sites shows how brand impersonation and installer trust can do the heavy lifting for attackers.
BotHelper RAT Turns a Windows Desktop Into a Remote Viewing Post
A newly analyzed .NET Windows trojan combines live screen streaming, command execution, file downloads, and restart-resistant persistence into one unusually interactive intrusion tool.
Exposed Docker Control Planes Are Becoming a Launchpad for AI Agent Abuse
Carbonato shows how a reachable Docker daemon can be turned into an installation path for a legitimate AI agent, then reshaped by altering its persona file rather than rewriting code.
Python Stealer Kits Are Turning Browser Sessions Into Reusable Keys
A configurable Windows infostealer aimed at dozens of browsers shows how saved passwords, card data, and session cookies can become the raw material for account takeover.
MacSync’s Upgrade on macOS: Why a Cleaner Infection Chain Is a Harder One to Stop
The latest MacSync campaign points to a more layered macOS threat model, where staged loaders, encrypted components, cloud-hosted handoffs, and a persistent backdoor can make defensive triage slower and less certain.