SIGNALMONK
Wireless & RFID Security Expert
Professional Profile
SignalMonk leads security operations on Wi-Fi, BLE, RFID, and wireless IoT.
Key Skills
Wireless sniffing; BLE exploitation; RFID cloning detection; Secure IoT communication; Radio forensics
Major Achievements
Uncovered a corporate theft via cloned badges.
Articles by SIGNALMONK
Thousands of Ruby Gems, One Registry, and a Very Modern Abuse Pattern
A large GemStuffer package cluster shows how open source registries can be pushed into data collection and workflow abuse, while the OpenAI connection remains an attribution question, not a confirmed root cause.
The Hidden Broker: Why a New Malware Family Chose MQTT as Its Nervous System
BambooToken turns a routine messaging protocol into a cross-platform control channel, showing how ordinary infrastructure can become a stealth layer for malware.
MQTT at the Center: BambooToken Shows How Ordinary Messaging Can Carry Malicious Control
A newly disclosed malware family uses a brokered publish/subscribe protocol to manage Windows and Linux hosts, underscoring how everyday telemetry plumbing can become a covert command layer.
Windows’ Old Script Door Is Back in the Crosshairs
A phishing operation is abusing mshta.exe, the built-in Windows HTML Application launcher, to execute malicious HTA files, inspect victim systems, and potentially reach for credentials or local secrets.
Telnet, Tiny Tooling, and a New IoT Botnet Playbook
KATARU shows how a weak remote-login service and a compact Linux utility set can turn exposed devices into candidates for root-seeking malware and DDoS abuse.
SloppyRAT Builds the Quiet Path for a Ransomware-Style Break-In
A Windows RAT delivered through a multi-stage ClickFix chain is described as a tool for reconnaissance, covert execution, and network movement before any obvious damage appears.
SloppyRAT Adds a Quiet Layer Before Ransomware Strikes
A newly identified remote access trojan, a multi-stage ClickFix chain, and blockchain-based control suggest a malware path built for persistence and stealth, not just immediate disruption.
Android Ransomware Turns Phones Into Silent Fraud Tools
Mantax OTAX is described as a mixed Android threat that combines file encryption, spyware, credential theft, and remote control in one package.
Gigabud’s Quiet Trick: Turning Android’s Work Profile Into a Hiding Place
A mobile banking malware case shows how legitimate profile isolation can be repurposed for concealment, app cloning, and checks that may fail when the device looks normal from the outside.
When a Work Profile Turns Into a Fraud Hideout on Android
A reported banking-malware chain shows how Android’s own isolation features can be repurposed to blur the trail between a victim’s personal apps and financial fraud.
Trusted Tools, Hidden Payload: How a Legitimate Runtime Can Disguise a Backdoor
A user-approved remote session, PowerShell staging, silent MSI installation, and a normal Node.js runtime can create an intrusion path that looks far more like IT support than malware.
Registry Detour: A Control-Plane Slip That Turned a Trusted Developer Channel Risky
A module registry tied to Coder was reportedly pushed off course through Cloudflare infrastructure, showing how one routing change can put software trust, secrets, and provisioning logic under pressure.
When the Perimeter Turns Hostile: PoisonedRefresh and the F5 Gateway Problem
A reported F5 BIG-IP APM exploitation path shows how an unauthenticated flaw at the access edge can turn a security appliance into a long-lived foothold.
The Minecraft Mod Trap: How a Trusted Performance Brand Became a Malware Lure
A trojanized game add-on dressed up as a Lithium companion shows how modding trust can be repurposed into password theft and remote control.
JSCeal and the New Value of a Stolen Browser Session
A compiled V8 JavaScript malware sample is being described as a reminder that once an attacker has a live session cookie, passwords and login prompts may no longer matter.
The Proxy Trap: How a Hidden Linux Implant Turned HAProxy Into a Traffic Filter
A trojanized edge proxy can sit in the middle of web sessions, making the compromise of one server matter far beyond that single machine.
Toy Ghouls Backdoors Use HiveMQ and Element as Control Channels
A financially motivated crew is linked to Windows backdoors that route command traffic through public MQTT and Matrix-based messaging infrastructure.
When Help Turns Hostile: Windows Remote-Access Tools Used as a Persistence Route
A late-August cluster of intrusions shows how trusted support software can be repurposed into a quiet backdoor path on Windows endpoints.
JSCeal Hides in V8 Bytecode, Blurring the Line Between Script and Stealer
A cryptocurrency-focused information stealer reportedly ships as compiled V8 bytecode in a .jsc file, a format that can make JavaScript malware harder to inspect while it hunts for browser credentials and HTTPS traffic.
When a Theme Package Turns into a Trap for iPhones and Wallet Owners
Thirteen malicious Composer packages allegedly bent trusted web pages into a delivery path for ad fraud, redirects, and a spyware campaign aimed at unpatched iOS devices.