SIGNALMONK
Expert en sécurité sans fil et RFID
Profil professionnel
SignalMonk dirige des opérations de sécurité sur Wi‑Fi, BLE, RFID et l’IoT sans fil.
Compétences clés
Capture de trafic sans fil; exploitation BLE; détection de clonage RFID; communication IoT sécurisée; forensique radio
Réalisations majeures
Mise au jour d’un vol d’entreprise via des badges clonés.
Articles de SIGNALMONK
The Build Pipeline Became the Target: What a Hijacked npm Maintainer Can Really Do
A compromised package publisher in the JavaScript ecosystem can turn routine installs into a path for secret theft, with CI/CD systems bearing the highest risk.
npm Cuts Off a High-Risk Token Class as Supply-Chain Pressure Hits JavaScript Publishing
A registry-level token reset shows how quickly package security can shift when long-lived publish secrets become a target.
Operation Dragon Whistle Turns Windows Shortcuts Into a Quiet Delivery Trap
A phishing campaign built around malicious LNK files shows how ordinary Windows artifacts and trusted services can be stitched into a stealthier intrusion path.
npm Package Linked to a Second Stage on Hugging Face Raises the Supply-Chain Stakes
A reported malicious npm package, terminal-logger-utils, is described as a dropper that fetches a second-stage Node.js payload and targets developer secrets such as SSH keys, Telegram sessions, wallets, and environment variables.
When Package Trust Becomes a Delivery Channel, the Build Never Stays Clean
A suspected npm supply-chain campaign tied to a malicious package and public artifact hosting shows how modern software can be reached through the dependency graph rather than the front door.
Automation Is Eating the Web: Thales Puts Malicious Bots at 40% of Requests
A new bot report points to a web economy where machine traffic is no longer background noise, but a major part of the attack surface.
Fake Utilities, Real Theft: How TamperedChef Turns Software Trust Against Users
A malvertising campaign built around lookalike productivity apps shows how easily a polished download page can become a delivery system for stealers.
The Quiet Cloud Entry That Can Sit for Months
Exposed Redis is not just a misconfiguration problem; in Kubernetes environments it can become a durable foothold for botnet activity that is hard to spot and harder to evict.
TamperedChef Shows How “Helpful” Software Can Become the First Malware Stage
Trojanized productivity tools, stealer payloads, and RATs are a reminder that the most dangerous download can look like the most ordinary one.
Gremlin Stealer’s New Trick: Hiding Its Nervous System Inside .NET Resources
A newly identified Gremlin Stealer variant is using encrypted .NET resource sections to conceal command infrastructure and theft logic, a move that pushes malware analysis away from simple string hunting and toward runtime inspection.
When Trust Becomes a Service: The Malware-Signing Pipeline Behind Fox Tempest
A signing workflow meant to validate software became a criminal trust broker, showing how valid certificates can be turned into a delivery tool for malware and ransomware.
When a Shared Inbox Becomes a War Room: GraphWorm’s Quiet Cloud Trick
A malware campaign tied to Webworm shows how a trusted Microsoft cloud service can be repurposed as a low-noise control channel, forcing defenders to watch identity and file activity as closely as network traffic.
When a Tap Becomes a Trap: Android Malware and the Quiet Power of NFC Relay
A newly identified Android malware family, tied to NFC relay abuse and kiosk-style confinement, shows how contactless trust can be bent without breaking the protocol.
The One-Letter Package That Turned Dependency Trust Into a Trap
A near-identical Go module name shows how typos in dependency resolution can turn routine builds into a supply-chain risk, with DNS reportedly used as part of the payload’s control path.
Chrome’s Protected Memory Isn’t the Finish Line for Infostealers
VoidStealer is a reminder that browser hardening can still be undercut when malware waits for secrets to appear in memory, where encryption no longer helps.
Fake Updates, Real Persistence: The macOS Stealer Hiding Behind Google’s Name
A newly identified SHub Stealer variant called Reaper shows how brand spoofing and deceptive installers can turn a normal-looking update prompt into a long-lived macOS foothold.
When Chat Apps Meet Windows Utilities, Malware Gets Harder to Spot
A reported campaign tied to UAC-0184 shows how message-based lures, bitsadmin, and HTA files can form a low-noise attack chain on Windows endpoints.
When a Loader Hides in Plain Sight, the Clipboard Becomes the Target
A reported CountLoader campaign shows how Windows-native scripts, staged execution, and memory-resident payloads can turn a routine infection path into a theft mechanism aimed at crypto users.
Leaked Worm Code Turns npm Into a Faster Malware Conveyor Belt
A new round of malicious package uploads shows how a public code leak can shorten the path from research-grade malware to copycat supply-chain abuse.
Gremlin Stealer Turns .NET Resources Into a Hiding Place
A new Gremlin Stealer variant appears to tuck malicious payload material into .NET resources, a move that can make static inspection less effective while the infostealer hunts for cookies, tokens, cards, and wallet data.