NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
Claude-Brand Lures Turn a Search Habit Into a Remote-Control Trap
A Claude Desktop-themed download flow is being used to deliver SectopRAT, showing how ad-driven redirection and fake installers can turn brand trust into a credential and file theft problem.
The Ruby Package Trap That Waited Hours Before Turning Servers Into Miners
A reported RubyGems campaign used delayed execution and sandbox checks to keep trojanized libraries quiet until they could launch XMRig and start covert Monero mining.
When a Text Editor Turns Into a Loader: The Notepad++ Plugin Trap
A Windows campaign tied to UAC-0099 shows how a familiar plugin model can become an execution path for a malicious DLL.
Trusted Editor, Hidden Payload: Why a Notepad++ Wrapper Matters to Windows Defenders
A legitimate Notepad++ 8.8.3 executable has been linked to a reported malware chain, showing how trusted software can be used as a delivery wrapper without any claim that the editor itself is broken.
TrickBot Hides in a Wireshark-Themed Update While DNS Carries the Noise
A familiar Windows malware family is being linked to a persistence trick that blends into routine admin work, while its control traffic shifts into DNS and away from the more obvious web channels.
A Fake Json Library, a Hidden Betting Hook, and a Log-Shaped Exit
A trojanized NuGet package reportedly masqueraded as Newtonsoft.Json, stayed useful for ordinary .NET apps, and only turned hostile inside a betting backend where integrity mattered most.
WebDAV, rundll32, and a Fileless Burglary of Browser and Telegram Secrets
A Windows delivery path built on trusted components and remote file retrieval is being used to chase passwords, active sessions, and wallet-related data with unusually little on-disk noise.
The WebDAV Lab Hiding in Plain Sight
An exposed file-sharing endpoint was described as a malware rehearsal space, where operators tested lure files, shortcut abuse, and Windows delivery paths tied to PureRAT and credential-stealing payloads.
Image Files as Bait: How Interview Lures Are Being Used to Slip Malware Past Developer Trust
A resurfaced recruitment-themed campaign is using SVG files as a delivery container, while a separate Ruby ecosystem intrusion underlines how quickly software trust can be turned against developers.
ACR Stealer and the Browser Vault Problem That Keeps Defeating Passwords
Microsoft’s warning about a surge in ACR Stealer activity is a reminder that modern intrusions often begin with stolen browser state, not a dramatic breach of the network perimeter.
The Browser Became the Vault: Starland RAT and the Quiet Theft of Trust
A reported malware campaign uses a Python RAT and a PowerShell implant to hunt browser credentials and more than 40 crypto wallets, showing how one user-level compromise can become a financial problem fast.
The Font That Wasn’t a Font: Why a Simple Email Lure Can Still Reach Windows
A phishing wave labeled “TTF Trap” uses fake font files to make business-themed emails look routine, reminding defenders that the dangerous part is often the click, not the theme.
Mac Users Put the Keyboard on the Line in a New Terminal Trick
ClickLock Stealer shows how a pasted command, not a zero-day, can become the most dangerous part of a macOS infection path.
NadMesh Turns AI Plumbing Into a Botnet Hunting Ground
A Go-based malware family is being described as a reusable attack framework for exposed AI services, with scanning, credential theft, and more than 20 remote code execution vectors folded into one operator-controlled mesh.
When a Fake Bank Promo Becomes a Phone Hijack
A Telegram lure impersonating UniCredit points to a deeper mobile threat: an Android banking trojan built for on-device fraud, not simple password theft.
TuxBot’s Real Trick Wasn’t Speed - It Was Reach
A modular IoT botnet framework tied to 17 processor architectures shows how attackers can scale across fragmented device fleets while still leaving defenders useful clues.
GigaWiper Turns One Implant Into a Spy, a Backdoor, and a Wrecker
Microsoft Threat Intelligence identified a modular malware family that can collect intelligence, maintain remote access, and switch to destructive wiping on command.
Android’s Debug Door Just Became a Malware Shortcut
RedHook is reported to be abusing Wireless ADB, showing how a legitimate developer feature can become a high-value control path on infected phones.
Rust, Search Poisoning, and a Quiet C2 Channel: The MODBEACON Problem
A reported Chinese-linked RAT pairs fake software downloads with gRPC-based command traffic, showing how modern delivery and transport choices can make old malware tradecraft harder to spot.
GigaWiper’s Real Threat Is Not Speed - It Is Choice
The destructive malware described here stands out because it bundles several impact modes into one implant, letting operators switch between wiping and encryption rather than relying on a single blunt tool.