SIGNALMONK
Wireless & RFID Security Expert
Professional Profile
SignalMonk leads security operations on Wi-Fi, BLE, RFID, and wireless IoT.
Key Skills
Wireless sniffing; BLE exploitation; RFID cloning detection; Secure IoT communication; Radio forensics
Major Achievements
Uncovered a corporate theft via cloned badges.
Articles by SIGNALMONK
Casbaneiro’s Quiet Trap: Banking Malware That Wakes Up Only for the Right Website
A Latin American banking trojan campaign reportedly used a simple but effective trick: stay quiet until the victim visits a targeted financial site, then begin its banking-related command-and-control activity.
When the Stealer Leaves the Browser: AI Workspaces Become the New Prize
A Rust-based infostealer campaign is shifting the theft playbook from passwords to the local files, tokens, and connector settings that make AI assistants and coding agents useful.
When the Phone Arrives Dirty: The Firmware Risk Behind Midnight Mimosa
Some Android phones are said to carry malware before the first app is ever installed, turning the trusted firmware layer into the real attack surface.
When a Poem Becomes a Botnet Map
A mining campaign tied to exposed AI and developer services shows how ordinary web-facing tools can be folded into a resilient criminal infrastructure.
npm’s Trust Chain Turns Toxic in the MALFEX Package Cluster
A Windows-focused npm supply-chain campaign shows how a routine dependency install can become a delivery path for remote access malware and credential-stealing code.
Poem-Driven C2: The Hidden Trick Behind a New Wave of AI-Service Malware
A malware campaign called PoeLLM is using a GitHub-hosted poem to help infected servers find command-and-control infrastructure, showing how exposed AI and developer tools can be turned into a control plane.
When Malware Reads the Ledger: The New Problem of Blockchain-Powered C2
Security research points to a supply-chain tactic in which public blockchains help malware refresh its command infrastructure after it is already on a compromised system.
A Poisoned npm Release Turned a Trusted Name into a Supply-Chain Trap
A single malicious package version can become a delivery system for secret theft, credential abuse, and wider propagation risk across developer workflows.
CastleStealer’s New Trick Turns a Stealer Into a Live Intrusion Tool
A C# infostealer first seen in April 2026 is now reported to carry remote shell capability, a shift that can turn stolen data into active command execution on compromised machines.
MATCHBOIL Grows Teeth: The Malware That Learned to Hide Better
A C# downloader is not supposed to look like a hardened implant, but MATCHBOIL now carries sandbox checks, commercial .NET obfuscation, deceptive interfaces, and recurring command-and-control traffic.
When a Terraform Plugin Turns Into a Workplace Intruder
A malicious Terraform provider has reportedly been used to steal developer credentials and plant backdoors, showing how infrastructure automation can become an execution path for cross-platform compromise.
Phones That Arrive Dirty: The Hidden Risk of Malware in Android Firmware
A preloaded Android threat on low-cost handsets is a reminder that sometimes the compromise starts before the first tap, not after the first download.
Fake Verification Screens Are the New Malware Conveyor Belt
A campaign tied to more than 100 compromised websites shows how a trusted page can be turned into a command prompt for the victim's own Windows machine.
Fake Verification, Real Payload: How Compromised Sites Became Stealers’ Delivery Lines
A wave of injected JavaScript turned more than 100 websites into a trust trap, using a fake Cloudflare-style check to push LunexStealer through a user-driven execution chain.
When a Common Setup Tool Becomes Botnet Cover: Cling and the Quiet Abuse of STUN
A botnet tied to internet-exposed IoT and networking devices shows how ordinary NAT-traversal traffic can be repurposed to hide command-and-control behavior.
Linux Backdoor ClingSTUN Turns a Standard NAT Tool into a Hidden Reachability Layer
A malware family tied to abused STUN traffic and boot-time persistence shows how ordinary network plumbing can be repurposed to keep compromised Linux devices reachable.
ClingSTUN and the Quiet Theft of IoT: When Backdoors Turn Devices into Relay Infrastructure
A Linux backdoor tied to 24 IoT vulnerabilities shows how routine device exposure can be repurposed into remote access and proxy infrastructure.
The Perimeter’s Fake Face: Linux Backdoors That Pose as Mail Security Gear
Three newly identified Linux implants imitate legitimate Asian mail-security products, turning trusted-looking edge software into a camouflage layer for stealthy access.
A Fake Zoom Installer Smuggled a Universal macOS Backdoor
A counterfeit Zoom package targeting Macs carried CloudSyncD, a backdoor wrapped inside a universal Mach-O payload and extracted only when the installer ran.
When a Banking Trojan Turns Android’s Trust Features Against It
RATHat shows how a mobile trojan can chain Accessibility access, wireless debugging, and a disputed AI label into something closer to device control than simple credential theft.