SIGNALMONK
Esperto di sicurezza wireless e RFID
Profilo professionale
SignalMonk guida le operazioni di sicurezza su Wi-Fi, BLE, RFID e IoT wireless.
Competenze chiave
Sniffing wireless; Exploitation BLE; Rilevamento del cloning RFID; Comunicazioni IoT sicure; Radio forensics
Risultati principali
Scoperto un furto aziendale tramite badge clonati.
Articoli di SIGNALMONK
One Stealer IP, a Hidden Maritime Scam Grid
A single RedLine-linked host became the starting point for mapping infrastructure that appears designed for maritime-themed spear phishing and BEC support.
When a Signed Driver Turns Into a Blindfold for EDR
Ransomware operators are leaning on vulnerable Windows kernel drivers to weaken endpoint defenses before encryption starts, and the trust model itself is part of the problem.
Fake Perplexity Extension Turned Chrome Searches Into a Quiet Target
A lookalike browser add-on used a trusted AI brand to win installs, showing how extension permissions can turn ordinary searches into sensitive telemetry.
SimpleHelp Login Trust Broken, Malware Chain Follows
A critical authentication bypass in SimpleHelp’s OIDC flow may have let attackers obtain technician access and deliver two malware families, turning a remote support tool into a high-risk entry point.
The DLL That Wore a Security Badge: Mistic’s Quiet Path Into Windows
A new Windows backdoor is reportedly hiding behind a Microsoft-style component name, using DLL sideloading and self-cleaning behavior to make incident response harder.
Millenium RAT’s Windows Push Points to a Cleaner, Harder-to-Hunt Malware Model
Group-IB’s analysis of Millenium RAT v4.* ties 62,289 Windows infections in more than 160 countries to Telegram bot communication, a combination that can blur malicious traffic inside ordinary cloud use.
Package Trust Under Siege: Miasma’s Latest Move Cuts Across npm, GitHub Actions, and Go
The latest Miasma-linked supply-chain activity shows how a single poisoned release can pressure multiple trust layers at once, from package registries to build automation.
Trusted npm Packages Become the Doorway in a Quiet Secret-Harvesting Campaign
A poisoned-package wave tied to Mini Shai-Hulud, Miasma, and Hades is pushing supply-chain risk into the heart of developer workstations and CI/CD pipelines.
LokiBot’s New Cover Story: Hashes, Legacy Crypto, and a Harder Target for Analysts
A new loader variant shows LokiBot using API hashing and 3DES-encrypted C2 configuration to make static analysis harder.
Old Malware, New Script Chain: Why LokiBot Still Fits Modern Windows Defense Gaps
A recent LokiBot campaign pairs obfuscated JScript with PowerShell, showing how native Windows scripting can still carry commodity credential theft past noisy perimeter controls.
SharkLoader Turns Trusted Windows Paths into a Quiet Launchpad
A newly named loader linked to the StrikeShark cluster shows how public-facing application exposure, DLL side-loading, and in-memory staging can turn a routine foothold into a much harder problem.
ClawHub Malicious Skills Deliver macOS Infostealers Through Base64 curl-pipe-bash Droppers
CyberPress reports that malicious skills in ClawHub are being used to deliver macOS infostealers via Base64-encoded curl-pipe-bash droppers.
SharkLoader Turns a Diplomatic Intrusion Into a Broader Beacon Problem
A newly named loader family linked to StrikeShark shows how a small foothold can become a wider intrusion chain when the real goal is to stage Cobalt Strike Beacon.
When Crimeware Loses Its Nervous System, the Hustle Slows Down
A coordinated disruption of infrastructure linked to Amadey and StealC shows why takedowns aimed at command channels can matter even when infected machines are still out there.
Why a Quiet Backdoor Matters More Than a Loud Ransom Note
Mistic looks less like a headline-grabbing smash-and-grab and more like the kind of foothold that can be traded, reused, or handed off inside the ransomware economy.
Fake Outlook Page, Real Endpoint Risk: The Browser Backdoor Playbook Behind Edgecution
A lookalike update portal and a malicious Edge extension show how a browser lure can turn into a path toward local process control when native messaging is in play.
When a RAR File Becomes a Delivery System for Windows Persistence
A targeted campaign tied to Ukraine’s UAV ecosystem shows how a booby-trapped archive, a script loader, and a decoy document can turn routine file handling into a foothold.
When a Mac App Becomes a Moving Target: The FlutterShell Case
A macOS malware family linked to remote JavaScript delivery shows how attackers can shift meaningful logic off the binary and into infrastructure that can change at any time.
When Flutter and WebViews Become a Backdoor’s Quietest Route
A macOS malware family named FlutterShell shows how ordinary app frameworks can be repurposed for runtime command execution without looking like a classic implant.
When Malware Moves by Itself, the Clock Starts Ticking
A virus and a worm may sound like close cousins, but their propagation model changes the defensive playbook, the speed of spread, and the window to contain damage.