IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Fake AI Downloads, Real Trust Abuse: How Signed Binaries Became a Malware Delivery Trick
Reported GitHub-hosted impostors themed as ChatGPT and Claude point to a sharper problem in malware delivery: a valid signature can still sit inside a hostile package.
Free Stealer, Hidden Snare: The Marsalek Kit That Reportedly Fed on Its Users Too
A free malware-as-a-service offering aimed at gamers reportedly did more than harvest victim data - it also sent that material back to its creator, a reminder that crimeware marketplaces can be built on betrayal as much as code.
Stealer Malware Is Chasing AI Logins, Not Just Passwords
Reported infostealers linked to WardenStealer and Aoki are being associated with AI-tool credentials, a shift that puts session material and API secrets in the same blast radius as ordinary browser theft.
Inbox Temptation, Scripted Risk: The XLoader Chain Hiding Behind a Purchase Order
A business-looking email can be the first step in a malware chain, but the real danger begins only if the attached script is run.
When the Password Changes, the Token May Still Live
A wave of infostealer activity is putting AI developer workstations under the microscope, where stolen local credentials can outlast a simple password reset.
Silent Installers, Loud Consequences: The Windows Bundle Trap Behind a New Monetization Push
A deceptive download chain is reportedly disguising itself as games, cracked apps, and utilities, then installing software that can use a PC’s network and compute resources without informed consent.
When a Trusted Update Turns Hostile: Inside the cPGuard Linux Backdoor Case
A security tool’s update path reportedly became the delivery route for a malicious script, exposing how quickly trust can be weaponized when software distribution is compromised.
When the TV Box Fights Back: The x.cpe Backdoor Story Hidden in Android Firmware
Google’s disruption of a large Android botnet highlights a harder problem than takedown: if malware lives in firmware, the device may survive the cleanup.
Trusted Names, Untrusted Files: How a Signed AI Binary Can Become a Malware Delivery Trap
A reported campaign tied to fake GitHub projects shows how DLL sideloading can turn a legitimate executable into a launch point for malware without proving any breach of the named software vendors.
A Botnet in the Box: How a Factory-Loaded Android Backdoor Turned Devices Into Infrastructure
A reported 1.3 million-device Android botnet shows how firmware-level compromise can outlast ordinary cleanup and blur the line between product supply chain and criminal control.
When a Trusted Installer Turns Hostile: The Risk Hidden Beside a Signed Windows App
The reported Yoba campaign shows how a legitimate-looking executable can become a delivery vehicle when a malicious DLL sits in the same folder and Windows loads it first.
Inside the Box: How a Firmware Backdoor Turned Android TV Hardware Into a Botnet
Google and partners reportedly disrupted XCPE, but the deeper story is the supply-chain risk of malware that survives below the app layer and may outlast ordinary cleanup.
Diplomatic Decoys, Hidden Shortcuts, and a RAT Chain Built for Quiet Windows Intrusions
A reported multi-stage campaign uses document-themed bait and Windows-native execution paths to deliver PapRAT, but the confirmed victim impact remains unproven in public material.
When Malware Starts Scoring Its Own Victims, the Crimeware Playbook Changes
VOLTA-AUTODOXER is described as a Windows infostealer that steals credentials, sessions, and wallet data, then uses AI to estimate which victims may be worth more to criminals.
When a Coding Extension Starts Talking Back: The Cursor Marketplace Incident
A malicious Claude Code extension reportedly collected host details and attempted a reverse SSH tunnel, showing how trusted developer tools can become remote-access risks without proving a full breach.
When Malware Starts Ranking Its Loot, Defenders Get a New Problem
VOLTA-AUTODOXER is reportedly a Windows infostealer that adds an unusual triage layer: it uses an LLM to sort stolen data by monetization value, while still targeting browser credentials, cookies, and workplace accounts.
NetamLoader Reportedly Lurks Inside a Custom Windows 10 Build Used by Asian Government Entities
A reported .NET loader chain highlights how configuration files, update paths, and signed components can be twisted into a stealthy execution path without proving a Windows flaw.
Malicious Claude Code Extension Tries to Plant a Persistent SSH Backdoor
A trojanized developer extension distributed through a marketplace reportedly attempted to set up unauthorized remote access on workstations, a reminder that trusted tooling can become a supply-chain attack path.
Trusted Windows Paths, Untrusted Payloads: NetamLoader Turns Familiar Software Into a Delivery Trap
A newly described loader reportedly abuses legitimate Microsoft components to run malicious code, complicating detection and showing how signed software can still be used in a hostile chain.
When a Coding Assistant Becomes a Doorway: The Disputed Extension Behind a Persistent SSH Risk
A trojanized VS Code extension tied to Claude Code has pushed a mundane developer add-on into the center of a supply-chain dispute, with researchers describing code that could set up persistent SSH access.