IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
Search Tricks, Fake Software Pages, and a Python Stealer Built to Catch the Curious
A reported campaign uses impersonation sites and search engine poisoning to push ArmorSteal, a malware family described as targeting passwords, browser cookies, authentication tokens, and crypto wallet data.
Fake Software Doors, Real Malware Risk: How a Search Trap Can Turn Into ArmorSteal
Reported lookalike download sites for Chocolatey and Microsoft Activation Scripts show how SEO poisoning can push users toward a credential-stealing malware path, even when the real brands are not involved.
Stadia RAT: A Reported Shift From Credential Theft to Remote Control
A malware offering tied to StealC reporting appears to add interactive control features, but the real-world reach of the build remains unconfirmed.
Fake Update, Real Trap: The Android Banking Malware That Turns Trust Into a Weapon
Hirudo is reported to combine a lure app, a second-stage payload, and a banking-app replacement flow that targets the way Android users trust updates and identity.
Fake Android Updates Are Turning Banking Phones Into Remote-Controlled Targets
A reported Android malware campaign blurs the line between app updates and cyber intrusion, exposing users to credential theft and app-manipulation claims.
Artifact Trapdoor: How the LiteLLM Supply-Chain Attack Put AI Secrets at Risk
A compromised release pipeline reportedly shipped malicious wheels and container images, but public evidence does not establish successful theft of credentials or secrets.
When a CAPTCHA Becomes the Payload: The Windows Tool Hidden Inside a Search Trap
A lure built around Amazon-themed search results and a fake verification page reportedly pushed users toward a command-chain that used Windows' finger utility and was associated with Lumma Stealer.
When a Tor Exit Turns Hostile: The SSH Trap Behind a Reported Relay Takeover
A claimed campaign against hundreds of Tor exit relays shows how anonymity infrastructure can become a pressure point without breaking SSH cryptography itself.
Release Trust Snapped: A Hijacked Developer Account and the OVHcloud CLI
A short-lived swap of release binaries in the OVHcloud CLI shows how one compromised publisher identity can turn a routine download path into a supply-chain hazard.
How Old Malware Still Shapes the Fight Against Ransomware and AI
A historical look at Creeper, Reaper, and modern ransomware shows how attackers and defenders keep forcing each other to adapt.
Backdoor Allegation Turns a WordPress SEO Plugin Into a Supply-Chain Warning
Rank Math PRO was reportedly distributed with malicious code through its normal delivery path, a reminder that trusted software channels can carry risk when package integrity is broken.
Trusted Plugin, Untrusted Payload: The Rank Math PRO Malware Incident Raises the Stakes for WordPress Owners
A premium WordPress plugin was reportedly used to distribute malware in a limited release window, putting site operators back on alert for supply-chain risk and post-install compromise.
Trusted WordPress Code, Untrusted Payload: The Rank Math PRO Incident
A reported malware event tied to Rank Math PRO 3.0.123 shows how a plugin update can become a distribution risk long before defenders know whether anything else on the site was touched.
When a Trusted CLI Release Becomes the Attack Surface
A compromised GitHub repository and a developer account turned a software distribution channel into the threat vector, but the available evidence does not confirm execution, theft, or the full blast radius.
A Trusted Backup Tool, a Fleeting Tamper Window, and the Malware Question No One Can Answer Yet
A brief supply-chain disturbance around AOMEI Backupper reportedly pushed a downloader linked to ShinyRoad, but delivery alone does not prove execution, infection, or impact.
Malware in the Update Pipe: The Rank Math PRO Package That Broke the Trust Model
Rank Math PRO version 3.0.123 was reported to have been shipped in compromised packages, but the known facts stop at distribution - not installation, execution, or downstream harm.
A Font File, a Workspace Trap, and a 94-Repo Shadow Trail
Researchers say a GhostAction-linked cluster widened from malicious workflow abuse to a more local trick: luring developers into a project that could launch a credential stealer through VS Code if the task was triggered.
When a Developer Shortcut Becomes the Trapdoor
A fake Web3 accelerator reportedly used malicious npm packages to push malware, while a repackaged AI tool may have rerouted model traffic through attacker-controlled infrastructure.
Hidden Native Code in npm Package Raises a Supply-Chain Alarm
Researchers reportedly tied the package "imgdecode" to MALFEX after finding a Windows native addon that contained a shellcode loader, a pattern that demands careful review but does not itself prove any victim compromise.
When a Font File Becomes a Delivery System, Developer Trust Becomes the Target
A GitHub campaign tied to GhostAction shows how repository config, disguised assets, and VS Code automation can turn an ordinary project clone into a risk decision.