IRONQUERY
Database Forensics Engineer
Professional Profile
Extracts hidden truth from compromised databases.
Key Skills
Database forensics; Query reconstruction; Transaction analysis; Data-exfiltration detection; SQL anomaly detection
Major Achievements
Reconstructed fraudulent transactions deleted by an insider.
Articles by IRONQUERY
Infostealer Malware Turns Toward AI Workflows, and Developer Secrets Become the Prize
Recent Aoki samples reportedly add collection routines for credentials and session files tied to Claude, ChatGPT, and Cursor, raising the stakes for infected developer endpoints.
ClickFix Lure, Loader, Tunnel: A Small Chain That Nearly Reached Ransomware
Investigators reportedly saw a social-engineering chain move from ClickFix to a loader and then to remote access, with ransomware assessed as the likely objective but not observed.
Quiet Tunnel, Loud Risk: ClickFix Chain Reportedly Set the Stage for Ransomware
A reported ClickFix intrusion used the Lorem Ipsum Loader and a Python tunneling implant to create remote access, but defenders contained the case before ransomware was deployed.
Encrypted at the Door: The KGB RAT Case Shows How Malware Hides in Plain Sight
A Windows RAT wrapped in obfuscation and a built-in crypter illustrates how attackers try to slow analysis, frustrate detection, and buy time on the endpoint.
Android Banking Apps Turned Inside Out by a New Credential Thief
Hirudo shows how mobile malware can move beyond fake screens and try to make the banking app itself part of the attack.
Fake Apple Prompts Turn macOS Trust Into a Credential Trap
A marketed macOS malware kit is drawing attention for a simple but effective trick: impersonating Apple-style dialogs to harvest passwords before handing control to a persistent remote-access payload.
Cheap Phones, Expensive Trust: The Hidden Malware Problem Inside Android Firmware
A preinstalled implant on low-cost Android devices shows how supply-chain compromise can turn consumer hardware into ad fraud and proxy infrastructure before the buyer ever touches an app store.
A Windows Loader Built to Keep Talking When Defenders Pull the Plug
AvisLoader is a reminder that modern malware does not need a single fragile server when encrypted peer-to-peer links, user-driven execution, and shortcut abuse can keep operations alive.
WhatsApp ZIPs, Windows SYSTEM, and a RAT That Hides in Plain Sight
A staged Windows intrusion uses a chat-delivered archive and a WebSocket command path to push malware into the highest local privilege tier.
When Terraform Becomes the Payload: A Trojanized Provider Turns DevOps Trust Into Risk
A malicious Terraform provider shows how one tainted plugin can turn infrastructure automation into an execution path inside developer and CI/CD environments.
When a Phone Arrives Already Infected, Trust Becomes the First Casualty
A firmware-bundled Android campaign turns low-cost phones into ad-fraud and proxy relays, showing how the real attack surface can begin before first boot.
When iPhone Spyware Learns to Whisper: P7 DarkSword Turns Toward Wallets and Remote Tasking
A newly described DarkSword variant appears built for quieter compromise, with on-device keychain theft, crypto-wallet targeting, and bidirectional control that can complicate detection and response.
When a Cheap Phone Arrives Pre-Tainted: The Hidden Risk Inside Android Firmware
A malware campaign tied to low-cost Android devices shows why the real security boundary may be the factory image, not the app store.
Chrome’s New Shield Meets a More Flexible Stealer
A C# infostealer is drawing attention for pairing browser-secret theft with remote command execution and encrypted, low-volume exfiltration.
Exposed AI Servers Are Becoming the New Workhorses of Crypto Crime
PoeLLM is being used in a cryptomining campaign that turns public-facing AI systems into mining platforms, scanners, and launch points for more abuse.
npm’s Trusted Path, Weaponized: MALFEX Shows How a Package Install Can Become Malware Delivery
A long-running campaign in the npm ecosystem has been linked to malicious packages that delivered RATs and stealers, turning routine dependency installs into a supply-chain risk.
npm’s Trust Layer Becomes a Delivery Route for Windows Malware
A persistent package campaign shows how a familiar developer registry can be used to plant loaders, stealers, and remote-control tools aimed at everyday credentials and crypto secrets.
When a Trusted SDK Turns Toxic: The Tensorlake npm Compromise and the Hidden Risk in AI Toolchains
A tainted Tensorlake package in npm is a reminder that software supply chains can turn into credential traps long before defenders notice the first suspicious request.
When Phishing Hides Its Trail in Public Blockchains
A malware campaign pairs email lures with Ethereum and TON to refresh command-and-control locations without relying on a fixed server address.
Blockchain as a Hideout: Malware Is Chasing the Secrets Behind the Build
A reported campaign pairing ChainDrop and PolinRider shows how cloud and CI/CD identities can become the real target when malware uses blockchain-based command channels.