SIGNALMONK
Esperto di sicurezza wireless e RFID
Profilo professionale
SignalMonk guida le operazioni di sicurezza su Wi-Fi, BLE, RFID e IoT wireless.
Competenze chiave
Sniffing wireless; Exploitation BLE; Rilevamento del cloning RFID; Comunicazioni IoT sicure; Radio forensics
Risultati principali
Scoperto un furto aziendale tramite badge clonati.
Articoli di SIGNALMONK
Fake Android Screens, Real Money: The Overlay Trick Behind a New Banking Trojan Wave
A mobile banker labeled Rokarolla shows how phishing pages, look-alike prompts, and overlay-style credential theft can turn a single tap into a financial compromise.
Deno Turns into a Trojan Horse as Phishing Pressure Pushes the First Click
A modular JavaScript implant reportedly uses Deno permission flags, while inbox flooding and Teams impersonation help force the execution decision.
The Android Permission Trap Behind a New Banking Trojan
Rokarolla shows how a legitimate accessibility feature can be turned into a fraud engine when deception, sideloading, and weak permission hygiene meet.
Fileless Phantom Stealer and the New War Over Browser Credentials
A malware campaign identified as Fileless Phantom Stealer combines memory-only execution with anti-analysis behavior while focusing on browser credentials, a pattern that complicates file-based detection.
OnionDrop and the Windows Trust Trick That Keeps Paying Off
A loader built around DLL sideloading is being used to deliver multiple infostealers, and historical YARA hunting suggests the campaign has left a wider trail than a single sample would show.
Rokarolla Turns Android Convenience Into a Fraud Pipeline
A newly described Android Trojan is tied to crypto and banking targets, showing how clipboard access, call handling, and accessibility abuse can become a practical fraud toolkit.
Rokarolla Turns an Android Phone into a Payment-Tampering Tool
Security researchers say the new banking trojan blends PIN capture, SMS interception, clipboard rewriting, and security-control suppression into one mobile fraud stack.
The Windows File Trick That Can Make a Scanner Chase Its Own Tail
A recursive junction pattern known as GhostTree shows how filesystem metadata can create path-explosion risk for security tools, especially when reparse points are not handled with care.
When a Trusted Relay Becomes a Cloak: What DragonForce Allegedly Hid Inside Microsoft Teams Traffic
A reported abuse of Microsoft Teams relay infrastructure shows how ransomware crews may try to blend command-and-control into ordinary cloud traffic instead of relying on obvious malicious hosts.
Arch’s AUR Incident Exposes the Quiet Power of Package Trust
A wave of malicious uploads pushed Arch Linux to suspend new account registrations, turning a community repository into a live lesson in supply-chain risk.
From Hidden WordPress Code to a Blocked Windows Loader: How a Web Compromise Tried to Cross the Line
A chain linking compromised WordPress sites, blockchain-hosted payload delivery, and a user-driven Windows execution attempt ended with rundll32.exe being stopped before GULoader could initialize.
A WordPress Twist on Malware Delivery Turns the Visitor Into the Target
A compromised site, selective traffic filtering, and a ClickFix lure point to a staged attack chain built to push Windows users toward a GULoader infection.
When Official Android Stores Start Acting Like Malware Delivery Channels
More than 50 apps were linked to MagicAd, a trojan that kept serving ads after closure and exposed how persistence can hide inside normal Android behavior.
Fake Premium Tutorials Turn a Familiar Brand Into a Windows Command Trap
Short-form videos promising free Spotify Premium have been used as a lure, with Windows users directed toward PowerShell commands that can deliver malware.
Overlay Tricks, In-Memory Execution, and the Loader Behind Multiple Stealers
GoFlateLoader stands out not for flashy evasion, but for a simple packaging pattern that helps multiple infostealers reach the execution stage.
BLUERABBIT Blends Theft, Encryption, and Wiping in One Windows Intrusion Tool
The Golang-based backdoor is reported to combine remote access, reconnaissance, cloud-assisted exfiltration, file encryption, and destructive disk wiping on Windows hosts.
Hijacked Edge Devices Are Turning into the Internet’s Quiet Scouting Grid
JDY has reappeared as a centrally controlled scanner across more than 1,500 SOHO and IoT devices, showing how compromised edge hardware can be repurposed for fast reconnaissance.
When a Package Install Becomes the Breach: dbmux and the New Trust Problem
A malicious npm package found inside developer tooling shows how supply-chain abuse can begin before an app even launches, turning routine installs into high-risk execution events.
Fake Utility Downloads Turn Search and Chatbots Into Malware Delivery Channels
A reported cryptojacking campaign uses spoofed system utilities, manipulated search results, and AI chatbot interactions to push ScreenConnect and mining malware.
MagicAd’s Android Playbook Shows How Adware Can Sneak In Through Trusted Doors
A reported Android Trojan used background ad flooding and platform-abuse tricks to blur the line between legitimate app behavior and hidden monetization.