IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
Malware in the Update Pipe: The Rank Math PRO Package That Broke the Trust Model
Rank Math PRO version 3.0.123 was reported to have been shipped in compromised packages, but the known facts stop at distribution - not installation, execution, or downstream harm.
A Font File, a Workspace Trap, and a 94-Repo Shadow Trail
Researchers say a GhostAction-linked cluster widened from malicious workflow abuse to a more local trick: luring developers into a project that could launch a credential stealer through VS Code if the task was triggered.
When a Developer Shortcut Becomes the Trapdoor
A fake Web3 accelerator reportedly used malicious npm packages to push malware, while a repackaged AI tool may have rerouted model traffic through attacker-controlled infrastructure.
Hidden Native Code in npm Package Raises a Supply-Chain Alarm
Researchers reportedly tied the package "imgdecode" to MALFEX after finding a Windows native addon that contained a shellcode loader, a pattern that demands careful review but does not itself prove any victim compromise.
When a Font File Becomes a Delivery System, Developer Trust Becomes the Target
A GitHub campaign tied to GhostAction shows how repository config, disguised assets, and VS Code automation can turn an ordinary project clone into a risk decision.
When a Repository Becomes a Run Command: The Hidden Risk Behind Developer Trust
A reported GhostAction campaign points to a sharper edge of software supply-chain abuse: repository content that may be used to trigger code on a developer’s own machine.
Six Servers, Two Payloads, One Delivery Trick: The ROMULUS Trail Raises the Stakes
A reported ClickFix infrastructure cluster tied to multiple payload routes shows how malware operators can separate delivery from payload, complicating attribution and detection.
GhostBat’s Quiet Play: Android’s Permission Layer Becomes the New Payment Battleground
A reported GhostBat variant points to a familiar but dangerous pattern on Android: if an app can abuse accessibility access and overlays, the fight shifts from the bank’s backend to the screen in your hand.
Infostealer Malware Turns Toward AI Workflows, and Developer Secrets Become the Prize
Recent Aoki samples reportedly add collection routines for credentials and session files tied to Claude, ChatGPT, and Cursor, raising the stakes for infected developer endpoints.
ClickFix Lure, Loader, Tunnel: A Small Chain That Nearly Reached Ransomware
Investigators reportedly saw a social-engineering chain move from ClickFix to a loader and then to remote access, with ransomware assessed as the likely objective but not observed.
Quiet Tunnel, Loud Risk: ClickFix Chain Reportedly Set the Stage for Ransomware
A reported ClickFix intrusion used the Lorem Ipsum Loader and a Python tunneling implant to create remote access, but defenders contained the case before ransomware was deployed.
Encrypted at the Door: The KGB RAT Case Shows How Malware Hides in Plain Sight
A Windows RAT wrapped in obfuscation and a built-in crypter illustrates how attackers try to slow analysis, frustrate detection, and buy time on the endpoint.
Android Banking Apps Turned Inside Out by a New Credential Thief
Hirudo shows how mobile malware can move beyond fake screens and try to make the banking app itself part of the attack.
Fake Apple Prompts Turn macOS Trust Into a Credential Trap
A marketed macOS malware kit is drawing attention for a simple but effective trick: impersonating Apple-style dialogs to harvest passwords before handing control to a persistent remote-access payload.
Cheap Phones, Expensive Trust: The Hidden Malware Problem Inside Android Firmware
A preinstalled implant on low-cost Android devices shows how supply-chain compromise can turn consumer hardware into ad fraud and proxy infrastructure before the buyer ever touches an app store.
A Windows Loader Built to Keep Talking When Defenders Pull the Plug
AvisLoader is a reminder that modern malware does not need a single fragile server when encrypted peer-to-peer links, user-driven execution, and shortcut abuse can keep operations alive.
WhatsApp ZIPs, Windows SYSTEM, and a RAT That Hides in Plain Sight
A staged Windows intrusion uses a chat-delivered archive and a WebSocket command path to push malware into the highest local privilege tier.
When Terraform Becomes the Payload: A Trojanized Provider Turns DevOps Trust Into Risk
A malicious Terraform provider shows how one tainted plugin can turn infrastructure automation into an execution path inside developer and CI/CD environments.
When a Phone Arrives Already Infected, Trust Becomes the First Casualty
A firmware-bundled Android campaign turns low-cost phones into ad-fraud and proxy relays, showing how the real attack surface can begin before first boot.
When iPhone Spyware Learns to Whisper: P7 DarkSword Turns Toward Wallets and Remote Tasking
A newly described DarkSword variant appears built for quieter compromise, with on-device keychain theft, crypto-wallet targeting, and bidirectional control that can complicate detection and response.