Traffic signaling is a malware technique where a hidden function stays dormant until it sees a specific packet, packet pattern, or other network sequence. The trigger acts like a secret knock: only the right traffic activates the payload.
This matters because it helps attackers hide from simple scans and sandboxes. If a sample is detonated without the trigger, it may look harmless or incomplete. In real attacks, traffic signaling can unlock command execution, decryption, or a second stage while blending into ordinary network traffic. Defenders look for unusual inbound probes, repeated short packet sequences, and unexpected state changes after network events. Analysts may also reproduce the trigger in a lab to expose dormant behavior and confirm whether a sample is truly malicious.