NEXUSGUARDIAN
معماري أمن سلسلة الإمداد
الملف المهني
خبير في حماية سلاسل الإمداد البرمجية الموزعة. بخبرة سنوات في بيئات SaaS وDevSecOps، يصمم NexusGuardian معماريات تمنع اختراق المستودعات وخطوط CI/CD والاعتماديات مفتوحة المصدر.
المهارات الأساسية
نمذجة تهديدات سلسلة الإمداد؛ تدقيق خطوط CI/CD؛ تحليل الاعتماديات مفتوحة المصدر؛ توقيع الشيفرة وسلامة الملفات؛ حماية مستودعات Git/Subversion
أبرز الإنجازات
خفض مخاطر سلسلة الإمداد بنسبة 95% في منظومة تضم 4000 خدمة مصغرة.؛ عثر على باب خلفي في وحدة Python تم تنزيلها 12 مليون مرة.
مقالات بقلم NEXUSGUARDIAN
Emoji-Laced Scripts Put a Classic Infostealer Back in the Spotlight
A reported business email compromise campaign uses emoji-filled JScript and a fileless execution chain to conceal Agent Tesla and steal credentials.
FTP’s Quietest Message Turned Into a Malware Delivery Trick
Security researchers traced a campaign that hides commands in FTP server banners to help deliver two previously undocumented Windows RATs, E4del and PINHOLE.
Android's New Quiet Threat: Malware That Can Pass Stolen Data Through Nearby Phones
Manic is described as a mobile threat that blends banking fraud, spyware, and remote-access behavior with an unusual relay path that can move data even when the victim device is offline.
When an Offline Android Phone Is Not Really Alone
Manic is the latest reminder that mobile theft does not always need the internet, only a nearby device and a way to move data quietly across short range.
MacSync’s Moving Target: Why One macOS Stealer Can Be Harder to Kill Than to Find
A macOS infostealer built around rotating domains shows how stolen credentials, browser data, and SSH material can become a durable theft pipeline if defenders only chase one hostname at a time.
Grandoreiro Reappears in Mexico After a Takedown, and the Detection Game Gets Harder
The banking trojan has resurfaced in a Mexico-focused campaign, with features designed to make security analysis and detection more difficult.
When the Phone Next Door Becomes the Escape Route
A new Android malware family has been described with a fallback exfiltration path that uses nearby infected devices, a design that pushes theft beyond ordinary internet monitoring.
Fake CAPTCHA, Real Kernel Pressure: The Web Lure That Tries to Silence Security Tools
A layered Windows intrusion chain blends compromised WordPress pages, user-pasted PowerShell, and driver abuse to push a reported stealer payload past endpoint defenses.
When a Banking Trojan Learns the Debug Menu, the Android Risk Changes Shape
ToxicPanda 2.0 is described as targeting 349 financial apps across 16 countries, with reported abuse of Android ADB suggesting a move toward deeper device control.
Fake Wallet Extensions Turn the Browser Into a Secret-Taking Machine
A cluster of lookalike Firefox add-ons targeting Rabby users shows how browser-wallet security can fail before encryption even enters the picture.
Rotating Domains, Fixed Habits: The Trail Behind a Mac Stealer Campaign
A moving domain set can hide infrastructure for a while, but repeated host and network behavior can still expose a macOS infostealer cluster.
MacOS Infostealer Swaps Domains Faster Than Defenders Can Block Them
MacSync Stealer shows how credential theft on Mac can survive exposure by treating infrastructure as disposable, not fixed.
The Forgotten Driver Page That Turned Into a Trust Problem
A stale support download, a malicious flag, and a domain with an old Asruex connection show how retired web assets can become risky long after a portal migration.
Old Support Link, New Malware Fear: The Hidden Risk of Driver Archives
A malware-flagged Realtek LAN driver on a legacy mini PC support page shows how stale downloads can turn ordinary maintenance into a supply-chain question.
Lookalike Gems, Real Damage: A Ruby Package Trap Aimed at Developers
A typosquatting run against RubyGems shows how a single mistaken install can push a Windows stealer toward browser credentials and crypto-wallet secrets.
Shadow hVNC Turns a Windows Desktop Into a Quiet Criminal Workbench
A Windows-focused malware-as-a-service package is advertised as a bundled access stack, mixing hidden desktop control, browser credential theft, reverse proxying, and persistence in one operator-friendly toolkit.
Evooo1Bot Shows How a Router Can Become Both a Weapon and a Hideout
A Linux botnet named Evooo1Bot is turning exposed routers, cameras, edge appliances, and enterprise systems into DDoS bots and proxy nodes, using a Mirai-like playbook that mixes brute force, exploitation, and relay abuse.
When a Recruiter Link Becomes a Malware Filter
A fake Web3 hiring pitch, a Google-hosted Apps Script page, and signed Windows malware show how attackers can use trust as a staging layer before they ever touch a victim’s machine.
Inside the Quiet Windows Trap: PE Corruption, WMI Persistence, and the Art of Staying Small
A custom backdoor found on a legacy Windows 7 workstation shows how attackers can combine file-format tampering with durable system hooks to stay hard to spot.
A 12 KB Windows Ghost Hid in Plain Sight
A tiny x64 backdoor dressed itself as Realtek software, used WMI for persistence, and tucked its command channel into a nearly empty desktop.ini file - a reminder that ordinary Windows features can become stealth infrastructure.