NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
Windows Script Hosts and Tor: The Hidden Path in a Crypto Clipper Campaign
A Windows-based crypto clipper reportedly leans on WScript, ActiveXObject, and Tor, a combination that can blur the line between ordinary scripting and malicious automation.
USB, Tor, and a Wallet Thief: A Small Malware Build With Outsized Reach
A newly spotted lightweight backdoor combines removable-media spread with cryptocurrency theft, showing how compact malware can still punch through modern defenses.
When a Trusted Work Tool Becomes Cover: The DragonForce Teams Intrusion
A reported ransomware case shows how a familiar collaboration platform can be abused as camouflage, turning normal enterprise trust into a hiding place for malware, theft, and encryption.
When the Vendor Update Turns Hostile: ShapedPlugin and the WordPress Trust Trap
A reported compromise of a plugin vendor’s update channel shows how routine maintenance can become a malware delivery path when the distribution layer itself is tampered with.
When the Fake Update Chain Breaks: A Law-Enforcement Hit on SocGholish’s Web Lures
Nearly 15,000 WordPress sites were cleaned and more than 100 servers were taken down, cutting into a delivery system that turns ordinary websites into malware launchpads.
Windows Scripting, USB Shortcuts, and Tor: The Hidden Machinery Behind a Crypto Clipper
Microsoft says a Windows-based cryptocurrency clipper has been active since February 2026, and its design leans on built-in scripting, shortcut abuse, and Tor-hosted command infrastructure.
Dropping Elephant’s Quiet Pivot: A China-Themed Loader, GitLab Pages, and a Memory-Resident RAT
A seven-week campaign tied to Dropping Elephant mixed trusted web services with fast-changing infrastructure, showing how attackers can turn ordinary publishing and chat-link features into malware delivery paths.
The Login Path Became the Trap: Why a Backdoored SSH Stack Is So Dangerous
When attackers tamper with the software that authenticates admins, the breach can sit inside the trust boundary itself.
The Resume Trap: How a Tiny Windows Shortcut Can Open a Bigger Door
A targeted lure dressed up as a job application shows how ordinary business workflows can be turned into an execution path for staged malware, persistence, and remote access.
When a Bank Lookalike Becomes an Execution Trap
Typosquatted domains, AI-built lure pages, and a ClickFix prompt can turn a routine web visit into PowerShell execution and a banking trojan dropper.
When a Friendly Voice Becomes the Bait: How Crypto Clippers Borrow Trust Before Stealing It
A reported campaign pairs AI-style narration, fake reputation signals, and a Rust-based clipboard hijacker to quietly redirect cryptocurrency payments.
When a Premium WordPress Plugin Becomes the Trojan Horse
A reported backdoor in paid ShapedPlugin add-ons shows how a trusted update path can turn routine maintenance into a supply-chain risk.
When Trusted Packages Turn Toxic: The Mastra npm Incident and the New Face of Credential Theft
More than 140 npm packages tied to the Mastra AI ecosystem were reported compromised, underscoring how a single poisoned dependency can become a delivery path for infostealers.
Windows Learns a New Trick: SprySOCKS Reappears with Multiple C2 Paths
A long-running espionage backdoor has been observed in Windows form, with transport flexibility and kernel-level stealth that can complicate routine detection.
Inside the REDCap Trap: When a Research Tool Becomes a Malware Beachhead
A campaign tied to Internet-exposed REDCap servers shows how a niche research platform can turn into a durable foothold for credential theft and covert access.
When Wallpapers Start Acting Like Software, Gamers Become the Easy Target
A gaming customization chain is being used to move malware through trusted community content, turning a familiar download flow into a quiet delivery system.
Rokarolla Puts Android Trust Chains Back in the Crosshairs
A newly disclosed Android banking trojan is being framed as capable of full device takeover, and the case highlights how dangerous permission abuse can be even without a kernel exploit.
When a Trusted Script Becomes a WordPress Gatekeeper
Tampered JavaScript tied to WordPress engagement tools can turn a normal admin session into a backdoor path, even when casual visitors see nothing unusual.
Browser Theft, Packaged Like Software: The OnyxC2 Playbook
A newly surfaced stealer shows how credential theft is being sold as a subscription business, with a web panel, a builder, and Cloudflare-fronted infrastructure.
Fake Update Screens Turn a Trusted Windows Habit Into a Credential Theft Trap
OnyxC2 is being pushed through deceptive installers that imitate routine software updates, showing how criminal tooling can turn normal download habits into account takeover risk.