SIGNALMONK
Wireless & RFID Security Expert
Professional Profile
SignalMonk leads security operations on Wi-Fi, BLE, RFID, and wireless IoT.
Key Skills
Wireless sniffing; BLE exploitation; RFID cloning detection; Secure IoT communication; Radio forensics
Major Achievements
Uncovered a corporate theft via cloned badges.
Articles by SIGNALMONK
When a Botnet Loses Its Backbone: Why the Sality Seizure Matters
A coordinated cyber disruption targeted Sality’s malware infrastructure, showing how defenders can still hit a long-running peer-to-peer botnet where it hurts most - its control plane.
The Job Test That Might Not Be a Test
Fake coding exercises are being used as a malware lure against developers, with researchers attributing the campaign with high confidence to Mirage Kitten.
When a Dependency Becomes the Trapdoor: Packagist Themes and the iPhone Browser Risk
A reported package-chain abuse on Composer's ecosystem shows how a single injected script can turn ordinary mobile page views into a credential-harvesting event.
npm’s Quiet Trapdoor: How a Trusted Codegen Package Became a Supply-Chain Hazard
A widely used npm package was pushed through multiple malicious releases, and researchers say the episode fits a broader pattern of install-time abuse that can turn developer tools into credential targets.
Fake AI Desktop Tools Are Becoming a New Stealer Trap
A Windows malware campaign used a fake Claude-branded desktop app to pull passwords and crypto wallet data into a familiar-looking download path.
Fake AI Desktop App Turns a Trusted Brand Into a Password Trap
A trojanized Electron installer impersonating Claude Opus 5 shows how believable software branding can be repurposed into a Windows infostealer delivery path.
The npm Package That Became a Worm Carrier
A developer tool with heavy weekly usage was turned into a supply-chain infection path, showing how install-time behavior can matter as much as runtime code.
How a Browser Add-on Became the Front Door for Wallet and Credential Theft
A cluster of malicious Chrome and Edge extensions shows how ordinary browser permissions can turn trusted add-ons into a quiet risk for logins and crypto activity.
When a CAPTCHA Becomes a Shell: The TerminalFix Playbook for Turning Trust Into Access
A fake verification page can do more than annoy users - in ClickFix-style campaigns, it can become the first step in a multi-stage intrusion chain that ends with a reverse-tunnel foothold.
When a Build Tool Turns Hostile: The npm Package That Put Developer Trust on the Line
A popular OpenAPI-to-TanStack Query generator was linked to a burst of malicious releases, raising a familiar but uncomfortable question: what happens when the tool chain itself becomes the threat surface?
Ten Minutes, Ten Bad Releases: How a Build Tool Became the Weakest Link
A reported malicious npm release campaign against a popular OpenAPI-to-TanStack Query code generator highlights how build-time developer tools can become high-value supply-chain targets.
Tax Lures, Modular Malware, and the Quiet Return of Packaged Access
A phishing chain tied to the cluster tracked as TA4922 shows how tax-themed email can be turned into a delivery path for a modular RAT, staged loaders, and follow-on access tooling.
When a CAPTCHA Becomes a Trap Door: Fake Verification Pages and the PowerShell Pivot
A disguised human-check page can push a browser session into terminal execution, turning ordinary Windows endpoints into reverse-tunnel footholds for attackers.
Tax Notices, Telegram Sales, and a Modular RAT: The Quiet Machinery Behind a Phishing Run
A tax-themed lure linked to TA4922 shows how localized phishing and commodity malware can be fused into a repeatable access playbook without proving full compromise.
The Resume Trap That Can Turn Research Inboxes Into Malware Runways
A credential-flavored archive can look ordinary for one second and hostile the next, especially when it hides a disguised executable linked to the SNOWLIGHT and VShell malware stack.
When a WordPress Plugin Starts Talking to the Browser
A reported campaign links auto-loading WordPress code, a malicious Service Worker, and layered delivery tricks into a web attack path built for stealth and resilience.
Fake CAPTCHA, Real Theft: How Hijacked WordPress Pages Became Windows Credential Traps
A campaign abusing compromised WordPress sites shows how a trusted webpage can be turned into a delivery layer for infostealer malware without a classic exploit chain.
When Malware Finds a Shortcut Through Ethereum
GoCaracal pairs interactive post-compromise features with a blockchain-based lookup for a replacement command address, making takedown work harder for defenders.
Spark RAT in Cambodia: When a Familiar Trap Meets a Weakened Defense Layer
A malware campaign aimed at Cambodian users and organizations combines social engineering with a vulnerable driver to make endpoint protection harder to trust.
SLEEPWALKER Turns Routine Windows Paths Into a Stealth Channel
A newly described Windows backdoor is notable less for flashy payloads than for how it can move operator commands through DNS, ICMP, SMB named pipes, raw packets, and VMware VMCI.