IRONQUERY
مهندس تحاليل جنائية لقواعد البيانات
الملف المهني
يستخرج الحقيقة الخفية من قواعد البيانات المخترقة.
المهارات الأساسية
التحليل الجنائي لقواعد البيانات؛ إعادة بناء الاستعلامات؛ تحليل المعاملات؛ كشف تسرب البيانات؛ كشف الشذوذ في SQL
أبرز الإنجازات
أعاد بناء معاملات احتيالية حذفها أحد المطلعين من الداخل.
مقالات بقلم IRONQUERY
Flying Eagle and the New Mobile Fraud Assembly Line
A reported Android RAT builder in China shows how malware can be packaged as a service, turning one tool into many bank-fraud campaigns.
The npm Package That Could Speak the Moment It Was Loaded
A malicious beta release in the JavaScript supply chain shows why disabling install scripts is not enough when code can execute at import time.
When a Package Import Becomes a Malware Trigger
Two beta npm releases in the @joyfill namespace were reported to carry an import-time payload that can launch a RAT inside Node.js, turning dependency trust into a runtime risk.
When a Trusted Installer Turns Hostile: CastleLoader’s Quiet Windows Trick
A malware loader is being described as using signed installers, Mark-of-the-Web removal, and in-memory staging to reduce the warning signs defenders usually rely on.
Fake AI Installers Are the New Phishing Kit for Developer Macs
A malvertising campaign dressed up as a Claude Code setup guide shows how one pasted command can turn a developer workstation into a map of reusable secrets.
When a Trusted Windows Name Turns Out to Be a Trap
A reported campaign called STANDOFF pairs Defender tampering with a fake csrss.exe process, showing how criminals can mix defense evasion, persistence, and monetization in one infection chain.
SourTrade Moves the Finish Line Into the Browser
A malvertising campaign is reportedly using browser-side assembly to build its payload in memory, a tactic that weakens file-based detection and complicates incident response.
When the Screen Lies: Malware Turns Windows Desktops Into a Stealth Channel
A browser opened on a hidden desktop can look harmless to the user while giving an operator a private workspace inside the same Windows session.
Screenshots, Side Loads, and Secret Seeds: The Mobile Trap Behind SparkKitty
A cross-platform spyware campaign shows how a single permission to read photos can turn ordinary crypto hygiene into a high-risk exposure point.
Steam Help Threads Became a Trapdoor for Cryptomining
A support-seeking gamer can become the execution step in a ClickFix lure, turning a forum reply into a path for XMRig and silent resource theft.
Fake Crypto Pages, Real Risk: How Browser JavaScript Can Assemble Malware in Memory
A malvertising run dressed up as Solana, Luno, and TradingView shows how a browser can be turned into part of the delivery chain, not just the place where victims land.
Scripted and Hidden: The Phantom Stealer Chain Riding on Business Trust
A phishing lure impersonating a logistics workflow and a two-step script chain show how credential theft now depends less on flashy exploits and more on ordinary Windows tools.
When the Browser Becomes the Payload Factory
A malvertising chain tied to trading and crypto lures shows how ServiceWorkers and SharedWorkers can be repurposed for runtime assembly inside the browser, complicating file-based defense.
Dolphin X Turns Infection Into a Sorting Problem for Attackers
The Windows malware family reportedly pairs broad secret theft with an "AI Profiler" that scores infected PCs, making it easier for criminals to focus on the hosts that look most valuable.
The Search Result That Opened the Door to a RAT
A malvertising chain that mimicked Claude Desktop and ran through Bing Ads shows how a trusted software search can become a post-exploitation problem almost instantly.
WARDEN’s Forum Pitch Turns Browser Secrets Into a Criminal Product
A newly advertised Windows stealer service points to a familiar but evolving threat model: attackers want browser sessions, wallet access, and reusable credentials more than they want a single password.
Inside the Lampion Lure: A Malware Chain Built to Look Ordinary
A Portuguese phishing run shows how attackers can hide a serious payload behind routine mail, layered scripts, and a trusted Windows launcher.
Lampion’s Portugal Trap: Why a 750MB Lure Can Still Begin With a Simple Email
The campaign highlights how localized phishing, staged scripts, and possible remote-access payloads can turn ordinary inbox traffic into a layered intrusion path.
RubyGems Became a Quiet Mining Lane, and SSH Was the Second Door
A cluster of malicious Ruby packages points to a familiar pattern in modern supply-chain abuse: trusted installs can become execution points, and trusted remote access can become a spread path.
TrickBot Quietly Rewired the Oldest Trick in the Book: DNS as a Remote Control Line
A new TrickBot variant points to a familiar criminal playbook: hide commands in normal-looking DNS traffic, then lean on Windows scheduled tasks and modular payloads to stay alive.