NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
When a Build Becomes the Breach: XCSSET v40 and the Risk Hidden Inside Xcode
A macOS malware variant tied to poisoned Xcode projects is being described as memory-heavy and evasive, with reported targeting of Chrome and Telegram that puts developer workflows under the microscope.
Fake Claude Installers Turn macOS Search Habits into a Credential Trap
MacSync is reported as a six-stage stealer and RAT that uses bogus Claude setup guides to target browser logins, Keychain secrets, and crypto wallets on macOS.
The npm Trust Trap: How a Trojanned Package Can Turn One Install Into Multi-OS Risk
A supply-chain compromise in the JavaScript ecosystem shows how a single package can become a delivery channel for malware that reaches Windows, macOS, and Linux environments.
Dysphoria and the End of the Easy Botnet Takedown
A rapidly changing IoT botnet is drawing attention because its layered control design may make disruption slower, noisier, and less decisive than a classic server seizure.
When the Build System Lies: Provenance Turns Into a Weapon in npm
A reported abuse of GitHub Actions shows how release automation can mint malware that still looks trustworthy to package consumers.
Fake Recruiter Pipelines Turn Job Hunters Into Wallet Targets
A Web3 hiring pretext is being used as a delivery path for cross-platform infostealer malware, showing how trust in recruitment can become an entry point for credential and crypto theft.
Flying Eagle Android RAT Traces Tied to 170 Servers as Source Code Spreads
A circulating Android malware kit, a counterfeit public-security app, and a cluster of shared server fingerprints show how mobile threats can be mapped even when the payload itself remains partly opaque.
One Fake Police App, 170 Servers, and the Hidden Shape of an Android RAT Network
A counterfeit public-security lure helped expose a clustered Android malware operation built around reused infrastructure, certificate patterns, and a leaked toolset known as Flying Eagle.
When Malware Is Split in Plain Sight, Package Review Stops Being Enough
A modular RAT tied to npm shows how attackers can hide in the seams between packages, not just inside a single suspicious file.
Tengu’s Trick Is Not Just Infection - It Is Refusal
A newly observed Mirai-derived botnet is being watched for anti-removal behavior that mixes watchdog reboots, binary corruption, and split cleartext-encrypted command traffic.
Browser Secrets and Seed Phrases: Why This Loader Chain Raises the Stakes
A CastleLoader-linked campaign is being used to deliver NeedleStealer, a combination that puts crypto recovery phrases and browser session data in the same threat model.
Router Ports, Hidden Relays, and the Quiet Reinvention of a Botnet
Dysphoria is being watched as it shifts from blunt DDoS abuse toward proxy-style infrastructure, a move that can make infected routers harder to spot, block, or trace.
Inside Dysphoria: The Botnet Turning IoT Chaos Into a Harder Target
An emerging IoT botnet is drawing attention for combining blockchain-based name resolution with layered control logic, a design that can make disruption more difficult for defenders.
Inside the Linux Impostor: How Tengu Turns a Trusted Service Name into Cover
A Mirai-based botnet strain is using fileless execution, encrypted control traffic, and a systemd-journald disguise to make ordinary Linux telemetry look ordinary.
Forty-Four Hidden Hops: The Redirector Network Masking a Modular Malware Engine
A cluster of leased servers disguised as harmless GitHub-style redirects shows how modern crimeware can hide control traffic behind familiar web patterns.
The Phone Gallery Became the Vault: SparkKitty’s Quiet Hunt for Secrets
A cross-platform mobile stealer is built around a simple idea: if the secret is already in a screenshot, photo access plus OCR may be enough to pull it out.
Stolen Sessions Are Becoming Ransomware’s Quiet Doorway
Infostealer data can give attackers a way into corporate systems, including paths that may bypass MFA.
The Quiet Sabotage Hidden Inside Build Files
A reported Doctor Web finding shows how C++ and C# project files can become a supply-chain attack surface, turning ordinary development workflows into a distribution risk.
Mixed Threat Signals, Same Defender Problem: Small Incidents Can Stack Fast
A roundup touching malware, kernel flaws, webmail espionage, industrial gear, and ransomware shows how varied threat activity can pressure security teams at once.
When the Browser Becomes the Factory Line for Malware
SourTrade turns ordinary web delivery into a per-victim build process, a design that weakens hash-based detection and blurs the line between browsing and infection.