IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Fake Installers, Real Access: The Two-Stage Malware Play Behind UAT-11795
A trojanized software installer can be more than a nuisance - in this campaign it is the handoff point for a remote access trojan and a separate in-memory backdoor built to keep control alive.
When a Font Attachment Becomes a Delivery Vehicle for Malware
A fake .ttf file can look harmless to a user and still serve as the first step in a multi-stage intrusion chain built around Lua loaders and commodity malware.
When a Paste Becomes a Breach: The Stealer Playbook Behind ClickFix
A user-driven lure can turn a single Windows command into credential theft, session replay, and local document harvesting from synced cloud workspaces.
The AI Control Plane Just Became Botnet Terrain
A Go-written malware operation reported to use 20+ RCE vectors shows how quickly AI connectors and MCP-style services can become a practical target for automation.
When a Windows Utility Becomes the Loader: The ACR Stealer Playbook
A credential thief spotted in mid-2026 used a trusted Microsoft binary and image-based concealment to reach for browser secrets, tokens, and documents.
Mac Users Tricked at the Trust Gate: ClickLock Stealer Turns Verification Into an Attack Path
A newly identified macOS stealer appears to rely on fake verification prompts and user-driven command execution rather than exploits or privilege escalation.
When a Fake macOS Prompt Starts Fighting Back, the Password Is the Prize
ClickLock Stealer shows how a pasted Terminal command, a forged login prompt, and a rapid app-kill loop can turn ordinary Mac workflows into pressure tactics.
Fake Meeting Apps, Real Malware: How a Trusted Download Became a Trap
A campaign tied to trojanized collaboration software shows how attackers can turn ordinary installer habits into a credential-theft and wallet-theft pipeline.
macOS Infostealer Turns Trusted Sessions Into a Quiet Entry Point
A reported macOS infostealer shows how stolen sessions, browser secrets, and fake wallet launch paths can move a single endpoint problem into account and crypto risk.
When a Mac Stealer Learns Your Secrets, the Crypto Raid Can Happen Later
A macOS-focused information stealer detected by MistEye is reported to collect wallet databases, Keychain material, browser data, and Apple Notes, then use those fragments for offline cryptocurrency theft attempts.
Old Rootkit, New Shadow: Daxin’s Return Shows How Windows Intrusions Hide in Plain Traffic
A resurfaced backdoor and a separate DLL implant found on the same Windows host highlight how attackers can combine low-level network manipulation with logon-time persistence.
The Botnet That Turns Bad Password Hygiene Into a DDoS Factory
A modular IoT malware framework shows how exposed Linux devices, Telnet, and layered persistence can turn routine neglect into a durable attack platform.
When a Trusted npm Namespace Turns Into a Delivery Channel for Malware
Four AsyncAPI packages were reportedly republished with malicious releases described as a RAT-focused Miasma build, while automatic propagation was disabled.
Poisoned Packages, Quiet Secrets: The Jscrambler npm Case Exposes a Familiar Trap
Multiple npm package versions tied to Jscrambler were poisoned in a supply chain attack, showing how a trusted update path can become the delivery mechanism for credential-stealing malware.
The Malware That Could Change Its Face: Why Adaptive Worms Matter
Research concepts around self-replicating, environment-aware malware point to a harder problem for defenders: code that may not stay still long enough for signature-based tools to catch it.
When a Visual Studio Project Becomes the Doorway: The Siggen Developer Trap
A Windows backdoor reported against developers shows how trusted build files and familiar services can be turned into stealthy malware infrastructure.
When a Build File Turns Hostile: The Quiet Malware Risk Inside Visual Studio Projects
A Windows Trojan documented in late 2025 is a reminder that in modern development, project files can become attack surface, not just configuration.
When a Build File Becomes the Breach Door
A multi-stage Trojan tied to Visual Studio project files shows how ordinary build logic can turn into a supply-chain attack surface.
The Server That Betrayed the Hunters Behind a WordPress Backdoor Wave
An internet-facing operator box leaked tools, logs, and target lists, turning a mass WordPress campaign into a rare view of how web intrusions are organized.
Hundreds of GitHub Repositories, One Malware Chain: The New Shape of Windows Staging
A staged abuse pattern built on public code hosting, Go, PowerShell, and dead-drop indirection shows how ordinary developer infrastructure can be repurposed for malware delivery.