NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
AI Lures, PowerShell Moves: Fake Claude Code Guides Become a Windows Trap for AsyncRAT
AI-branded decoys, Windows scripting, and Defender exclusions form a familiar abuse chain that ends with AsyncRAT.
BLUERABBIT Turns a Windows Foothold Into a Destructive Toolkit
A Golang backdoor tied to Windows environments now stands out for combining theft, file encryption, and wiping logic in one intrusion package.
Fake Mac Installers Are Turning Disk Images Into a Quiet Theft Channel
Malicious DMG files are being used to lure macOS users into opening lookalike installers, a simple trick that can put passwords and other secrets at risk.
Relay Nets That Refuse to Die: The JDY Botnet and the Edge-Device Problem
A botnet tied to roughly 1,500 compromised devices shows how exposed infrastructure can outlast disruption and keep serving as a covert relay layer.
Tax Lures, Hidden Payloads: Windows Users Are Being Steered Toward Memory-Resident Malware
Tax-branded phishing emails are being used to deliver in-memory malware on Windows, a tactic that shifts detection away from saved files and toward what happens after a user opens the attachment.
ClickFix Turns a Simple Copy-Paste Into a Backdoor Staging Ground
A social-engineering chain is being used to drop MLTBackdoor through user-run commands and disposable infrastructure, creating the kind of foothold that can support later ransomware activity.
A Rogue npm Package Put Developer Machines in the Crosshairs
The dbmux case shows why a routine package install can become an execution event, not a passive download, with developer endpoints serving as a high-value entry point for broader supply-chain abuse.
GitHub’s 105-Second Purge Exposed a Dangerous Shortcut in the Software Supply Chain
Dozens of Microsoft-linked repositories were disabled in a rapid enforcement wave, showing how trusted developer assets can be repurposed as malware distribution points.
When a Trusted Checkout Becomes the Trap
A digital skimming campaign aimed at Magento and Adobe Commerce checkout pages shows how attackers can abuse the trust around payment brands without breaking the payment network itself.
Weedhack Turns Minecraft Curiosity Into a Credential-Grabging Business
A subscription-style malware operation tied to Minecraft lures shows how fake mod sites, search poisoning, and social promotion can be turned into a repeatable theft pipeline.
When a Python Install Becomes the Attack Surface
A new wave of malicious PyPI artifacts shows how a small packaging trick can turn routine developer workflows into startup-time execution risk, especially in MCP-linked environments.
When a Stealer Comes Wrapped Like a Legit App
A reported Lucid Stealer build uses a Node.js Single Executable Application wrapper, showing how familiar software packaging can blur the line between benign delivery and criminal tooling.
Fast-Flux Domains Put Law Firm Extortion on a Moving Target
Silent Ransom Group is tied to attacks on U.S. law firms, and its use of DNS fast flux shows how criminal infrastructure can be made harder to block without changing the victim side of the playbook.
Lucid Stealer’s New Shell: Why a Node.js Wrapper Changes the Theft Game
A malware build described as Lucid Stealer blends browser credential theft, wallet targeting, and Discord token harvesting with a legitimate Node.js packaging format that can make the payload harder to recognize at a glance.
HTML Attachments Turn Google Redirects Into a Malware Delivery Chain
A malspam campaign uses a malicious HTML file, a zero-second meta-refresh, and a Google-owned ad-tech redirect to help move victims toward a reported .NET loader.
When a Trusted Redirect Becomes the First Step in a Malware Chain
A malspam campaign tied to a Google DoubleClick hop shows how attackers can hide risky delivery inside ordinary-looking web and email traffic, then hand off to a multi-stage .NET loader chain.
Microsoft’s GitHub Lockdown Exposes How Fast Trust Can Collapse in a Supply Chain Worm Event
Seventy-three repositories across four Microsoft GitHub organizations were affected, and access was disabled, but the deeper lesson is how quickly source-control trust can become an incident response problem.
C0XMO Puts a Modular Face on Old Botnet Tradecraft
A reported Gafgyt-family variant combines split-up spread logic with multi-architecture payloads and a DD-WRT flaw, a reminder that commodity malware is becoming more adaptable, not less dangerous.
Fake Mac Download Pages Turn a Trusted Click Into a Stealer Run
A macOS campaign tied to the SHub family shows how brand impersonation and ClickFix-style social engineering can turn ordinary software searches into browser and wallet theft risk.
The Browser Became the Pickup Point for AI Secrets
Malicious add-ons dressed up as useful tools are turning AI chats into browser-side data capture, putting prompts, histories, and pasted material at risk.