SIGNALMONK
Experto en seguridad inalámbrica y RFID
Perfil profesional
SignalMonk lidera operaciones de seguridad en Wi-Fi, BLE, RFID e IoT inalámbrico.
Competencias clave
Sniffing inalámbrico; explotación BLE; detección de clonación RFID; comunicación segura en IoT; forense de radio
Logros principales
Descubrió un robo corporativo mediante credenciales clonadas.
Artículos de SIGNALMONK
When a VPN Becomes Malware’s Shield: ToxicPanda’s Quiet Android Power Grab
ToxicPanda’s latest behavior shows how a familiar Android permission can be repurposed into a barrier against cleanup, updates, and user control.
Three Banking Malware Names, One Clear Warning: Mobile Fraud Is Getting Harder to Spot
Manic, Grandoreiro, and ToxicPanda 2.0 are a reminder that modern banking malware is no longer just about stolen logins - it is about persistent access, regional targeting, and longer-lived fraud operations.
Fake Gemini, Real Harvest: How AI-Themed Lures Feed Browser Credential Theft
A Windows installer posing as Google Gemini shows how brand impersonation and commodity infostealers can turn curiosity about AI into account takeover risk.
When a Build Step Becomes the Attack: Rust Crates and the onering Warning
A reported Rust supply-chain incident is a reminder that the most dangerous code may run before an application ever starts, inside the build pipeline itself.
Fake CAPTCHA, Real Damage: The ClickFix Playbook Learns to Muffle Endpoint Defenses
A new wave of lure pages and hand-entered PowerShell commands shows how attackers can turn ordinary verification prompts into a delivery path for defense-evasion malware.
Android’s New Fraud Layer: ToxicPanda 2.0 and the Rise of Invisible PIN Theft
A banking trojan family is being linked to invisible overlays, expanded device control, and a wider net of financial apps, showing how mobile fraud now attacks the screen itself.
WordPress Front Doors Turned Into a Malware Relay
A campaign tied to compromised WordPress sites is being used to push deceptive CAPTCHA prompts and a mix of ransomware, credential theft, file theft, and remote monitoring claims.
When Malware Stops Hiding on the Endpoint and Starts Renting the Cloud
TwinLoot is a reminder that modern intrusions can center on identities, tokens, and cloud telemetry, not just infected files on a laptop.
The App Looked Normal. Its Hidden JavaScript Did Not.
A campaign tied to Electron-based productivity tools shows how a legitimate desktop app can keep working as advertised while quietly carrying code paths that raise surveillance and post-compromise risk.
Android’s Live Wire: Why WebSocket-Controlled RATs Are a Dangerous Step Up
BTMob spotlights a mobile malware pattern that favors low-latency, operator-driven control, turning infected phones into interactive fraud endpoints.
GitHub Becomes the Quiet Highway for a Rust Backdoor
C2Looper v2 shows how developer infrastructure can be repurposed for command-and-control without any need for custom hosting.
Backdoor C2Looper Turns Legitimate Platforms Into a Stealthy Control Channel
C2Looper is a July 2026 backdoor that researchers link, with caution, to ransomware-related activity and to a delivery path that may involve ClickFix chains.
Android’s Newest Fraud Machine Puts Banking Apps on the Screen and the Attacker in the Chair
Octagon is described as an Android malware platform built for wallet and banking abuse, combining accessibility tricks, overlays, and hidden remote control in a way that fits modern live-fraud tradecraft.
ChainDrop and the New npm Trust Problem
A self-propagating npm worm reportedly spread without stealing a long-lived publishing token, pushing defenders to think about identity and workflow trust, not just secret theft.
Perimeter Machines Become Pirate Ports in a New Linux Botnet Wave
A newly identified Linux botnet is turning routers, firewalls, cameras, and other internet-facing gear into traffic relays, DDoS nodes, and possible credential-harvesting footholds.
Mac Browser Control Goes Live: Why AmnesiaStealer Changes the Shape of Session Theft
A newly identified macOS infostealer uses a ClickFix-style lure and a streaming module that can let an operator interact with the victim’s browser in real time.
When Malware Moves Onto the Chain, the Old Takedown Playbook Starts to Fray
Aeternum is reported to use Polygon smart contracts as its control channel, a design that shifts botnet coordination away from disposable servers and toward infrastructure that is harder to remove.
Suspected APT36 Cluster Raises the Possibility of LLM-Assisted Malware Craft
A newly observed set of custom malware families may show signs of AI-assisted development, while attribution to APT36 remains moderate-confidence rather than definitive.
Fake GitHub Pages, Real Browser Theft: How a New macOS Infostealer Turns Trust Into Access
AmnesiaStealer is being described as a macOS infostealer delivered through ClickFix-style lures, a reminder that on modern desktops the weakest link is often the person clicking the page.
When Malware Talks on Chain, Takedowns Lose Their Edge
Aeternum illustrates a quieter shift in botnet design: moving command traffic onto a public blockchain where ordinary server seizures matter less.