NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
When a Blue Check Becomes a Trap Door for Mac Users
A ClickFix-style campaign on X used trust and urgency to push macOS users toward a Terminal command that delivered malware.
When Devices Outlive Their Support, Attackers Move In Quietly
A weekly security roundup points to a familiar pattern: stale endpoints, obscure payloads, and consumer devices that behave more like unmanaged computers than appliances.
Two Million Ghost Devices, One Proxy Machine: The Hidden Layer Behind a Botnet Disruption
A reported disruption involving NetNut points to a wider problem in cybercrime: residential proxy infrastructure turns ordinary devices into disposable cover for abuse.
When a CAPTCHA Becomes the Malware Trigger
Fake Google and Cloudflare verification screens are being used as a trust trap, pushing victims to run commands that load a rotating mix of stealers, loaders, and remote access tools.
When a PDF Is Not a PDF: The VEIL#DROP Chain Hiding Malware in Plain Sight
A document-themed JavaScript lure, PowerShell, and Blogspot form a delivery chain that pushes PureLog Stealer into memory, showing how familiar tools can be bent into a stealthy malware pipeline.
Proxy Shadows: Why a Residential Network Takedown Matters Beyond One Brand
Google, with the FBI, Lumen, and other partners, reportedly moved against NetNut, also tracked as Popa, in a case that spotlights how residential proxy infrastructure can support malware command-and-control.
SharkLoader and the Windows Trapdoor That Can Hide Cobalt Strike in Memory
The reported chain turns DLL loading behavior into an execution path, showing how a trusted Windows mechanism can be bent to stage Beacon without obvious on-disk clues.
Invoice Lures, Shortcut Chains, and RAT Swapouts: The New Shape of Phishing Delivery
A fake invoice PDF, layered shortcuts, and public tunnel infrastructure form a compact delivery chain that can swap between multiple remote access trojans without changing the user-facing lure.
When a Web Shell Learns to Hunt for Passwords
An IIS foothold, a defense-impairment script, and a WDigest downgrade show how quickly server-side access can turn into a credential-theft workflow.
Fake AI Installers Are Becoming a macOS Trapdoor for Credential Theft
A reported MacSync Stealer campaign shows how sponsored search, brand impersonation, and terminal-based trust can turn a routine software install into a path to stolen secrets.
RustDuck and the Old Weaknesses That Keep Feeding New Botnets
A newly named botnet family is a reminder that exposed Telnet, password-only SSH, and unpatched public services remain a reliable path into both IoT gear and servers.
PyPI Poisoning Hits Telegram Bot Builders, and the Backdoor Hides in Plain Sight
A malicious package campaign tied to Telegram bot development shows how a trusted Python repository can become the delivery layer for server-side compromise.
When Malware Becomes a Relay: The Quiet Power of SystemBC
SystemBC, also tracked as Coroxy, shows how a Windows implant can matter less for encryption than for the hidden proxy layer that helps ransomware crews move unseen.
How Minecraft Mods and Ethereum Smart Contracts Can Power Harder-to-Disrupt Credential Theft
A malware package tied to a Minecraft modding path and on-chain control logic shows how ordinary-looking software can be turned into a resilient access theft tool.
When a Game Mod Becomes the First Stage of a Stealer Chain
A reported Minecraft Fabric mod campaign shows how trusted game add-ons can be used as an entry point for session-data theft and blockchain-resident command retrieval.
Gaslight Shows Malware Can Try to Trick the Analyst’s AI
A newly identified macOS implant is notable not just for stealing data, but for embedding text meant to derail AI-assisted triage.
Mistic’s Quiet Footprint: Why a Backdoor Tied to ClickFix Matters More Than the Label
A new malware family is drawing attention not for loud destruction, but for the way it blends social engineering, stealthy persistence, and post-compromise flexibility.
Npm’s Hidden Trapdoor: How Malicious Packages Can Exploit node-gyp to Target Developer Secrets
A supply-chain lure inside package install and build steps can turn routine development work into an execution window for credential theft, especially when teams trust native-addon metadata too quickly.
When a Browser Extension Starts Talking Back: The Windows Command Channel Hiding in Plain Sight
A phishing-led malware chain reportedly used Chrome’s native messaging path to move from browser space into Windows command execution, showing how ordinary integrations can become security boundaries in practice.
Google Play’s Trust Trap: A Document Reader Lure That Hid in Plain Sight
A utility-style Android app reportedly drew about 100,000 downloads before its hidden payload was switched on, showing how social proof can buy attackers time.