SIGNALMONK
Expert en sécurité sans fil et RFID
Profil professionnel
SignalMonk dirige des opérations de sécurité sur Wi‑Fi, BLE, RFID et l’IoT sans fil.
Compétences clés
Capture de trafic sans fil; exploitation BLE; détection de clonage RFID; communication IoT sécurisée; forensique radio
Réalisations majeures
Mise au jour d’un vol d’entreprise via des badges clonés.
Articles de SIGNALMONK
Fake Utilities, Real Theft: How TamperedChef Turns Software Trust Against Users
A malvertising campaign built around lookalike productivity apps shows how easily a polished download page can become a delivery system for stealers.
The Quiet Cloud Entry That Can Sit for Months
Exposed Redis is not just a misconfiguration problem; in Kubernetes environments it can become a durable foothold for botnet activity that is hard to spot and harder to evict.
TamperedChef Shows How “Helpful” Software Can Become the First Malware Stage
Trojanized productivity tools, stealer payloads, and RATs are a reminder that the most dangerous download can look like the most ordinary one.
Gremlin Stealer’s New Trick: Hiding Its Nervous System Inside .NET Resources
A newly identified Gremlin Stealer variant is using encrypted .NET resource sections to conceal command infrastructure and theft logic, a move that pushes malware analysis away from simple string hunting and toward runtime inspection.
When Trust Becomes a Service: The Malware-Signing Pipeline Behind Fox Tempest
A signing workflow meant to validate software became a criminal trust broker, showing how valid certificates can be turned into a delivery tool for malware and ransomware.
When a Shared Inbox Becomes a War Room: GraphWorm’s Quiet Cloud Trick
A malware campaign tied to Webworm shows how a trusted Microsoft cloud service can be repurposed as a low-noise control channel, forcing defenders to watch identity and file activity as closely as network traffic.
When a Tap Becomes a Trap: Android Malware and the Quiet Power of NFC Relay
A newly identified Android malware family, tied to NFC relay abuse and kiosk-style confinement, shows how contactless trust can be bent without breaking the protocol.
The One-Letter Package That Turned Dependency Trust Into a Trap
A near-identical Go module name shows how typos in dependency resolution can turn routine builds into a supply-chain risk, with DNS reportedly used as part of the payload’s control path.
Chrome’s Protected Memory Isn’t the Finish Line for Infostealers
VoidStealer is a reminder that browser hardening can still be undercut when malware waits for secrets to appear in memory, where encryption no longer helps.
Fake Updates, Real Persistence: The macOS Stealer Hiding Behind Google’s Name
A newly identified SHub Stealer variant called Reaper shows how brand spoofing and deceptive installers can turn a normal-looking update prompt into a long-lived macOS foothold.
When Chat Apps Meet Windows Utilities, Malware Gets Harder to Spot
A reported campaign tied to UAC-0184 shows how message-based lures, bitsadmin, and HTA files can form a low-noise attack chain on Windows endpoints.
When a Loader Hides in Plain Sight, the Clipboard Becomes the Target
A reported CountLoader campaign shows how Windows-native scripts, staged execution, and memory-resident payloads can turn a routine infection path into a theft mechanism aimed at crypto users.
Leaked Worm Code Turns npm Into a Faster Malware Conveyor Belt
A new round of malicious package uploads shows how a public code leak can shorten the path from research-grade malware to copycat supply-chain abuse.
Gremlin Stealer Turns .NET Resources Into a Hiding Place
A new Gremlin Stealer variant appears to tuck malicious payload material into .NET resources, a move that can make static inspection less effective while the infostealer hunts for cookies, tokens, cards, and wallet data.
Typos, Trust, and a Hidden Payload: npm’s Latest Malicious Package Trap
Four suspicious npm packages highlight how a single dependency mistake can turn routine installs into credential theft and possible denial-of-service abuse.
When an Image Becomes a Courier: The Stealth Chain Behind PawsRunner and PureLogs
A phishing-led delivery chain is using hidden data in media files to move a credential stealer into memory, showing how ordinary formats can be repurposed as covert transport.
OtterCookie Finds the Soft Spot: Developer Machines Become Live Credential Targets
A Node.js remote-access trojan is being examined as a real-time secret harvester, a reminder that one infected workstation can put source control, cloud access, and automation accounts at risk.
Gremlin Stealer and the Quiet Abuse of .NET Resource Files
A stealer malware family is being linked to a familiar but easily abused .NET feature, showing how ordinary packaging mechanisms can become a hiding place for payloads.
Shai-Hulud’s Code Has Found New Hands, and npm Is the Battlefield
A recently released malware codebase has reportedly been reused in attacks tied to the npm ecosystem, raising the odds that one worm can quickly become many variants.
Linux’s Quiet Credential Thief: Why a Recycled Rootkit Matters
OrBit is being described as a Linux rootkit used to harvest SSH and sudo credentials, with recent analysis framing it as a selectively weaponized clone of Medusa rather than a fresh invention.