NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
The Loader That Starts With a Lie: How Sauron Turns Conversation Into Code Execution
A newly identified malware loader linked to attacks in Germany shows how ClickFix-style prompts and voice phishing can turn human trust into an execution path.
When a Malware Loader Stops Trusting Domains, Takedowns Lose Their Grip
AvisLoader combines a ClickFix-style lure, an exposed staging server, and Tox-based command traffic, making simple website takedowns a weaker defensive answer.
The Domain Rotates, the Host Survives: What a Malware Network Leaves Behind
When lure domains vanish and new ones appear, the more durable clue may be the hosting layer that keeps serving the same abuse pattern.
Inside the New Hunt for AI-Laced Malware Footprints
Cisco Talos has put a metadata-first lens on malware research, aiming to spot AI-linked artifacts without forcing defenders to detonate suspicious files.
The Hidden Spine of a Malware Run: Why Rotating Domains Were Not the Whole Story
Four malware chains reportedly stayed active for months by swapping visible web fronts, while a steadier hosting layer kept reappearing underneath.
WordPress Malware Turns Trusted Plugin Plumbing Into a Persistent Backdoor
A new implant hides inside WordPress’s own mu-plugin path and pairs that persistence with Ethereum-based EtherHiding, making ordinary cleanup and manual review far less reliable.
When a Backdoor Learns to Survive: The Quiet Logic Behind Dual C2 Malware
A PowerShell implant tied to document theft shows how modern malware is built not just to intrude, but to keep talking when defenders knock out one command path.
When Package Trust Breaks: The GitHub-to-npm Path That Turned Into a Delivery Channel
A reported supply-chain incident tied to GitHub repositories and a scoped npm package shows how quickly identity abuse can turn routine publishing into a high-risk code path.
When a Maintainer Login Becomes a Malware Pipeline
A short-lived compromise of an npm package shows how release automation, repository permissions, and self-deleting payloads can turn trusted software delivery into a stealth channel.
MQTT Turns into a Secret Control Room for a Linux Backdoor
BambooToken shows how a mainstream messaging protocol can carry remote commands, host checks, and file theft without looking like classic malware traffic.
The Package That Waited Until You Ran It
A counterfeit npm dependency shows how a supply-chain lure can slip past install-time defenses and still wake up inside a live application.
RatHat and the Quiet Shift to Adaptive Mobile Malware
An Android trojan described as using AI for automation shows how mobile malware is moving beyond rigid scripts toward faster, more adaptive control.
The Signed Driver Trap Behind a New Credential-Stealing Campaign
Rapuncel pairs infostealer theft with kernel-level defense evasion, using a Microsoft-attested driver to knock out security tools before it goes after passwords, wallet data, and session tokens.
ClickFix Tempts Users, ChainScript Slips In, and Polygon May Be Hiding the Trail
A deceptive install flow, rotating disguise names, and a blockchain-linked command path show how modern malware campaigns try to outlast simple blocking.
npm’s Quietest Payloads Are Getting Harder to Spot
A malicious package in the npm ecosystem highlights a simple but stubborn truth: blocking install scripts does not stop code that waits until normal runtime to execute.
RatHat Turns Android Trust Into a Banking Trap
The latest Android banking Trojan headline is less about novelty than about method: credential theft, MFA capture, and the growing abuse of legitimate device features.
When Search Results Become a Malware Funnel
A campaign built on SEO-boosted GitHub lookalikes is using brand trust to push Rapuncel, a newly documented infostealer, without any confirmed breach of the companies being impersonated.
When Android Debugging Becomes the Doorway: The RatHat Case
A reported Android malware strain is drawing attention not for a classic exploit, but for turning trusted device features such as ADB and accessibility into a path out of the app sandbox.
Inside the Casino Cover: How Hidden C2 Domains Slip Past Enterprise Filters
A malware-control channel tied to PeckBirdy is being concealed inside gambling- and adult-themed domains, turning routine DNS noise into a hiding place for suspicious infrastructure.
Movie Lure, Remote Hands: How a Windows Torrent Trap Turns Files into a Battlefield
A newly identified Windows malware framework is using fake movie downloads to hand operators direct control over local files, raising the stakes from simple infection to interactive file tampering.