diff --git a/README.md b/README.md
index 5a21830..85f4969 100644
--- a/README.md
+++ b/README.md
@@ -51,8 +51,13 @@ OBD/USB port, a PC, smart appliances.
 | **Vehicle Comm** | Vehicle diagnostics and control — OBD-II, UDS, KWP2000, CAN-FD. Read fault codes, unlock doors, disable alarms, reprogram ECUs. |
 | **Message Forge** | Craft & parse ANY binary protocol — HEX, JSON, Protobuf, custom binary, XML. Build valid messages, inject payloads, fuzz protocols. |
 | **UI Studio**     | Modern UI effects showcase — glassmorphism, neon boxes, glitch text, particle effects, vapor waves, animated gradients, pulsing circles, status indicators. |
+| **Terminal Emu**  | Live terminal emulator showing fake "hacking" command execution, payload deployment, privilege escalation, shell access confirmation. |
+| **Data Stream**   | Animated hex dumps and packet captures — scrolling binary data, network traffic visualization, packet dissection in real-time. |
+| **System Monitor**| Target system dashboard — fake process list, CPU/memory/network load metrics, active connections, resource usage monitoring. |
+| **Attack Vis**    | Active attack visualization — scanning → enumeration → exploitation → privilege escalation → exfiltration stages with intensity feedback. |
+| **Log Streamer**  | Real-time colored log feed with alerts, successes, errors — watch "live" attack logs as they happen, credential captures, exploit confirmations. |
 
-## 43 modules total
+## 48 modules total
 
 **Discover**: Pin Scan, V-Sense, USB Enum, CAN Bus, Wizard  
 **Sniff & Replay**: UART Sniff, UART+, Protocol, Scope  
@@ -63,7 +68,8 @@ OBD/USB port, a PC, smart appliances.
 **Network Exploitation**: Ethernet Router, WiFi Clone, BT Dominator  
 **Automation & Analysis**: Polyglot, WiFi Dashboard, Exploit Chain, Honeypot  
 **Universal Communication**: Universal Proto, IoT Swarm, Industrial SCADA, Vehicle Comm, Message Forge  
-**System**: Theme, Settings  
+**Immersive Hacking**: Terminal Emu, Data Stream, System Monitor, Attack Vis, Log Streamer  
+**UI & Design**: UI Studio, Theme, Settings  
 
 ### Heavy exploitation (authorized use only)
 
diff --git a/src/core/shell.cpp b/src/core/shell.cpp
index 557acd4..e36bb3d 100644
--- a/src/core/shell.cpp
+++ b/src/core/shell.cpp
@@ -46,6 +46,11 @@ Module* makeIndustrialScada();
 Module* makeVehicleComm();
 Module* makeMessageForge();
 Module* makeUIStudio();
+Module* makeTerminalEmu();
+Module* makeDataStream();
+Module* makeSysMonitor();
+Module* makeAttackVis();
+Module* makeLogStreamer();
 
 void Shell::begin() {
   theme::load();
@@ -92,6 +97,11 @@ void Shell::begin() {
   add(makeVehicleComm());
   add(makeMessageForge());
   add(makeUIStudio());
+  add(makeTerminalEmu());
+  add(makeDataStream());
+  add(makeSysMonitor());
+  add(makeAttackVis());
+  add(makeLogStreamer());
   ui::bootSplash();
   drawMenu();
 }
diff --git a/src/modules/attackvis.cpp b/src/modules/attackvis.cpp
new file mode 100644
index 0000000..6390464
--- /dev/null
+++ b/src/modules/attackvis.cpp
@@ -0,0 +1,91 @@
+#include "../core/module.h"
+#include "../core/ui.h"
+
+// Attack Visualizer: animated exploit progression with intense visual feedback.
+// Shows attack stages with alarm effects, success states, real-time compromise status.
+// Makes exploitation FEEL urgent and active with glitch effects and neon alerts.
+
+class AttackVis : public Module {
+  enum Stage { SCANNING, ENUMERATING, EXPLOITING, ESCALATING, EXFILTRATING } stage = SCANNING;
+  uint32_t stageProgress = 0;
+  uint32_t targetCount = 0;
+  uint32_t compromised = 0;
+  bool alarmActive = false;
+  char msg[3][40] = {{0},{0},{0}};
+
+public:
+  const char* name() const override { return "Attack Vis"; }
+  const char* blurb() const override { return "active attack display"; }
+
+  void onEnter() override {
+    stage = SCANNING;
+    stageProgress = 0;
+    targetCount = 0;
+    compromised = 0;
+    alarmActive = false;
+    say("Initializing attack sequence");
+  }
+  void onExit() override { }
+
+  bool onKey(char c) override {
+    if (c == ' ') { nextStage(); return true; }
+    return false;
+  }
+
+  void tick() override {
+    stageProgress++;
+    if (stageProgress > 60) {
+      stage = (Stage)((stage + 1) % 5);
+      stageProgress = 0;
+    }
+
+    // Simulate targets discovered
+    if (stageProgress % 15 == 0) targetCount++;
+
+    // Simulate compromise
+    if (stage == EXFILTRATING && stageProgress % 10 == 0) compromised++;
+  }
+
+  void draw() override {
+    const char* sn[] = {"SCAN", "ENUM", "EXPLOIT", "ESCALATE", "EXFIL"};
+    const char* icons[] = {"📡", "🔍", "💣", "🔑", "📤"};
+
+    uint16_t stageColor = ui::accent();
+    if (stage == EXPLOITING || stage == EXFILTRATING) stageColor = ui::glow();
+
+    ui::lineC(0, stageColor, "%s %s [%u%%]", icons[stage], sn[stage], stageProgress * 100 / 60);
+
+    if (stage == SCANNING) {
+      ui::bar(2, stageProgress / 60.0f, ui::dim(), "scan");
+      say("[*] Targets found: %u", targetCount);
+    } else if (stage == ENUMERATING) {
+      ui::bar(2, stageProgress / 60.0f, ui::accent(), "enum");
+      say("[*] Collecting system info...");
+    } else if (stage == EXPLOITING) {
+      ui::bar(2, stageProgress / 60.0f, ui::bad(), "exploit");
+      say("[!] EXPLOIT ACTIVE");
+    } else if (stage == ESCALATING) {
+      ui::bar(2, stageProgress / 60.0f, ui::warn(), "privesc");
+      say("[!] Escalating privileges...");
+    } else if (stage == EXFILTRATING) {
+      ui::bar(2, stageProgress / 60.0f, ui::glow(), "exfil");
+      say("[+] Targets compromised: %u", compromised);
+    }
+
+    for (int i = 0; i < 3; i++) ui::line(7 + i, "%s", msg[i]);
+    ui::hintBar("[space]next  [`]back");
+  }
+
+private:
+  void say(const char* fmt, ...) {
+    for (int i = 2; i > 0; i--) strncpy(msg[i], msg[i-1], 39);
+    va_list ap; va_start(ap, fmt); vsnprintf(msg[0], 40, fmt, ap); va_end(ap);
+  }
+
+  void nextStage() {
+    stage = (Stage)((stage + 1) % 5);
+    stageProgress = 0;
+  }
+};
+
+Module* makeAttackVis() { return new AttackVis(); }
diff --git a/src/modules/datastream.cpp b/src/modules/datastream.cpp
new file mode 100644
index 0000000..7ae04a3
--- /dev/null
+++ b/src/modules/datastream.cpp
@@ -0,0 +1,70 @@
+#include "../core/module.h"
+#include "../core/ui.h"
+
+// Data Stream: animated hex dumps, packet captures, scrolling binary data.
+// Shows live "network traffic" with realistic packet data flowing in real-time.
+// Makes it feel like you're intercepting and analyzing actual network communications.
+
+class DataStream : public Module {
+  enum DataType { HEX_DUMP, PACKET_CAPTURE, BINARY_STREAM, ASCII_LOG } dataType = HEX_DUMP;
+  bool streaming = false;
+  uint32_t bytesCaptured = 0;
+  uint32_t packetCount = 0;
+  uint32_t scrollPos = 0;
+  char msg[3][40] = {{0},{0},{0}};
+
+public:
+  const char* name() const override { return "Data Stream"; }
+  const char* blurb() const override { return "live packet capture"; }
+
+  void onEnter() override {
+    streaming = false;
+    bytesCaptured = 0;
+    packetCount = 0;
+    scrollPos = 0;
+    say("Data capture: ready");
+  }
+  void onExit() override { streaming = false; }
+
+  bool onKey(char c) override {
+    if (c == 't') { dataType = (DataType)((dataType + 1) % 4); return true; }
+    if (c == ' ') { streaming = !streaming; if (streaming) { bytesCaptured = 0; packetCount = 0; } return true; }
+    return false;
+  }
+
+  void tick() override {
+    if (!streaming) return;
+
+    bytesCaptured += (64 + (packetCount % 128));
+    if (bytesCaptured % 256 == 0) packetCount++;
+    scrollPos++;
+
+    if (packetCount % 5 == 0) {
+      say("[PKT %u] %u bytes captured", packetCount, (bytesCaptured / 1024));
+    }
+  }
+
+  void draw() override {
+    const char* dt[] = {"HEX", "PACKETS", "BINARY", "ASCII"};
+    ui::lineC(0, ui::accent(), "Data Stream: %s  %s", dt[dataType], streaming ? "LIVE" : "idle");
+
+    // Simulate hex dump scrolling
+    ui::line(2, "00x%04x: 48 65 6c 6c 6f 20", scrollPos % 0xFFFF);
+    ui::line(3, "00x%04x: 57 6f 72 6c 64 21", (scrollPos + 1) % 0xFFFF);
+    ui::line(4, "00x%04x: 50 4b 54 00 41 42", (scrollPos + 2) % 0xFFFF);
+
+    ui::bar(5, (bytesCaptured % 2048) / 2048.0f, streaming ? ui::glow() : ui::dim(), "cap");
+
+    for (int i = 0; i < 3; i++) ui::line(7 + i, "%s", msg[i]);
+    if (streaming) ui::spinner(228, ui::BODY_Y + 1, ui::glow());
+    ui::hintBar("[t]ype [space]capture  [`]back");
+  }
+
+private:
+  void say(const char* fmt, ...) {
+    for (int i = 2; i > 0; i--) strncpy(msg[i], msg[i-1], 39);
+    va_list ap; va_start(ap, fmt); vsnprintf(msg[0], 40, fmt, ap); va_end(ap);
+  }
+};
+
+Module* makeDataStream() { return new DataStream(); }
diff --git a/src/modules/logstreamer.cpp b/src/modules/logstreamer.cpp
new file mode 100644
index 0000000..4be5983
--- /dev/null
+++ b/src/modules/logstreamer.cpp
@@ -0,0 +1,79 @@
+#include "../core/module.h"
+#include "../core/ui.h"
+
+// Log Streamer: real-time colored log output with alerts and status updates.
+// Shows live attack logs, system alerts, credential captures, exploit confirmations.
+// Scrolling log view that FEELS like you're watching a live pentest unfold in real-time.
+
+class LogStreamer : public Module {
+  enum LogType { ALL_LOGS, ALERTS_ONLY, SUCCESS_ONLY, ERRORS_ONLY } logType = ALL_LOGS;
+  bool streaming = false;
+  uint32_t logLines = 0;
+  uint32_t alerts = 0;
+  uint32_t successes = 0;
+  char msg[3][40] = {{0},{0},{0}};
+
+public:
+  const char* name() const override { return "Log Streamer"; }
+  const char* blurb() const override { return "real-time log feed"; }
+
+  void onEnter() override {
+    streaming = false;
+    logLines = 0;
+    alerts = 0;
+    successes = 0;
+    say("Log streamer: standby");
+  }
+  void onExit() override { streaming = false; }
+
+  bool onKey(char c) override {
+    if (c == 'l') { logType = (LogType)((logType + 1) % 4); return true; }
+    if (c == ' ') { streaming = !streaming; if (streaming) logLines = 0; return true; }
+    return false;
+  }
+
+  void tick() override {
+    if (!streaming) return;
+
+    logLines++;
+
+    if (logLines == 5) { alerts++; say("[ALERT] Intrusion detected"); }
+    if (logLines == 10) say("[INFO] Connecting to target");
+    if (logLines == 15) { successes++; say("[SUCCESS] Auth bypass"); }
+    if (logLines == 20) { alerts++; say("[WARNING] IDS alert"); }
+    if (logLines == 25) { successes++; say("[+] Privilege escalated"); }
+    if (logLines == 30) { alerts++; say("[CRITICAL] Rootkit loaded"); }
+    if (logLines == 35) { successes++; say("[SUCCESS] Data exfiltration"); }
+    if (logLines == 40) streaming = false;
+  }
+
+  void draw() override {
+    const char* lt[] = {"ALL", "ALERTS", "SUCCESS", "ERRORS"};
+    ui::lineC(0, ui::accent(), "Log Streamer: %s  %s", lt[logType], streaming ? "LIVE" : "idle");
+
+    // Fake log lines with colors
+    if (logLines > 0) {
+      ui::lineC(2, ui::glow(), "[%u] Streams active", logLines);
+    }
+
+    ui::line(3, "Alerts: %u  Success: %u", alerts, successes);
+
+    if (streaming) {
+      ui::bar(4, (logLines % 40) / 40.0f, ui::glow(), "log");
+    } else {
+      ui::line(4, "status: ready");
+    }
+
+    for (int i = 0; i < 3; i++) ui::line(7 + i, "%s", msg[i]);
+    if (streaming) ui::spinner(228, ui::BODY_Y + 1, ui::glow());
+    ui::hintBar("[l]ogtype [space]stream  [`]back");
+  }
+
+private:
+  void say(const char* fmt, ...) {
+    for (int i = 2; i > 0; i--) strncpy(msg[i], msg[i-1], 39);
+    va_list ap; va_start(ap, fmt); vsnprintf(msg[0], 40, fmt, ap); va_end(ap);
+  }
+};
+
+Module* makeLogStreamer() { return new LogStreamer(); }
diff --git a/src/modules/sysmonitor.cpp b/src/modules/sysmonitor.cpp
new file mode 100644
index 0000000..bdd0180
--- /dev/null
+++ b/src/modules/sysmonitor.cpp
@@ -0,0 +1,79 @@
+#include "../core/module.h"
+#include "../core/ui.h"
+
+// System Monitor: fake process list, CPU/memory/network load, real-time metrics.
+// Shows target system health like you're actively monitoring a live compromise.
+// Displays fake processes running on target, resource usage, active connections.
+
+class SysMonitor : public Module {
+  enum View { PROCESSES, NETWORK, MEMORY, CPU } view = PROCESSES;
+  uint32_t cpuLoad = 0;
+  uint32_t memUsed = 0;
+  uint32_t netIn = 0, netOut = 0;
+  uint32_t procCount = 0;
+  char msg[3][40] = {{0},{0},{0}};
+
+public:
+  const char* name() const override { return "System Monitor"; }
+  const char* blurb() const override { return "target metrics dashboard"; }
+
+  void onEnter() override {
+    cpuLoad = 45;
+    memUsed = 62;
+    netIn = 2048;
+    netOut = 512;
+    procCount = 47;
+    say("Target monitoring: active");
+  }
+  void onExit() override { }
+
+  bool onKey(char c) override {
+    if (c == 'v') { view = (View)((view + 1) % 4); return true; }
+    return false;
+  }
+
+  void tick() override {
+    cpuLoad = 40 + (rand() % 40);
+    memUsed = 55 + (rand() % 30);
+    netIn += (rand() % 256);
+    netOut += (rand() % 128);
+  }
+
+  void draw() override {
+    const char* vn[] = {"PROCS", "NETWORK", "MEMORY", "CPU"};
+    ui::lineC(0, ui::accent(), "System Monitor: %s", vn[view]);
+
+    switch (view) {
+      case PROCESSES:
+        ui::line(2, "sshd        [PID 432]  0.2%%");
+        ui::line(3, "bash        [PID 441]  0.1%%");
+        ui::line(4, "payload.elf [PID 512]  48.3%%");
+        say("Processes: %u running", procCount);
+        break;
+      case NETWORK:
+        ui::bar(2, netIn / 4096.0f, ui::glow(), "in");
+        ui::bar(3, netOut / 2048.0f, ui::accent(), "out");
+        say("Total: %u KB in, %u KB out", netIn / 1024, netOut / 1024);
+        break;
+      case MEMORY:
+        ui::bar(2, memUsed / 100.0f, ui::glow(), "mem");
+        say("Used: %u%% (%u MB)", memUsed, memUsed * 10);
+        break;
+      case CPU:
+        ui::bar(2, cpuLoad / 100.0f, ui::glow(), "cpu");
+        say("Load: %u%%", cpuLoad);
+        break;
+    }
+
+    for (int i = 0; i < 3; i++) ui::line(7 + i, "%s", msg[i]);
+    ui::hintBar("[v]iew  [`]back");
+  }
+
+private:
+  void say(const char* fmt, ...) {
+    for (int i = 2; i > 0; i--) strncpy(msg[i], msg[i-1], 39);
+    va_list ap; va_start(ap, fmt); vsnprintf(msg[0], 40, fmt, ap); va_end(ap);
+  }
+};
+
+Module* makeSysMonitor() { return new SysMonitor(); }
diff --git a/src/modules/terminalemu.cpp b/src/modules/terminalemu.cpp
new file mode 100644
index 0000000..a366bf0
--- /dev/null
+++ b/src/modules/terminalemu.cpp
@@ -0,0 +1,84 @@
+#include "../core/module.h"
+#include "../core/ui.h"
+
+// Terminal Emulator: fake terminal output showing live "hacking" commands.
+// Scrolling command execution, fake system responses, exploit payloads being sent.
+// Makes it FEEL like you're actively running commands and exploiting systems.
+
+class TerminalEmu : public Module {
+  enum Target { ROUTER, SERVER, DEVICE } target = ROUTER;
+  bool executing = false;
+  uint32_t lineCount = 0;
+  uint32_t cursorBlink = 0;
+  char cmdBuffer[40] = "";
+  char msg[3][40] = {{0},{0},{0}};
+
+public:
+  const char* name() const override { return "Terminal Emu"; }
+  const char* blurb() const override { return "live hacking terminal"; }
+
+  void onEnter() override {
+    executing = false;
+    lineCount = 0;
+    cursorBlink = 0;
+    strncpy(cmdBuffer, "# card-crack@target", 39);
+    say("Terminal initialized");
+  }
+  void onExit() override { executing = false; }
+
+  bool onKey(char c) override {
+    if (c == 't') { target = (Target)((target + 1) % 3); return true; }
+    if (c == ' ') { if (!executing) executeExploit(); return true; }
+    return false;
+  }
+
+  void tick() override {
+    if (!executing) return;
+
+    lineCount++;
+    cursorBlink = (millis() / 500) % 2;
+
+    // Simulate command execution
+    if (lineCount == 5) say("[+] Connecting to target...");
+    if (lineCount == 10) say("[+] Handshake successful");
+    if (lineCount == 15) say("[*] Payload size: 2048 bytes");
+    if (lineCount == 20) say("[+] Executing payload...");
+    if (lineCount == 30) say("[!] Access granted: uid=0");
+    if (lineCount == 35) say("[+] Shell spawned");
+    if (lineCount == 40) { executing = false; say("# Exploit complete"); }
+  }
+
+  void draw() override {
+    const char* tn[] = {"ROUTER", "SERVER", "DEVICE"};
+    ui::lineC(0, ui::accent(), "Terminal: %s", tn[target]);
+
+    // Simulate terminal with cursor
+    ui::line(2, "root@%s# ", tn[target]);
+    if (cursorBlink) {
+      ui::lineC(2, ui::glow(), "root@%s#_", tn[target]);
+    }
+
+    ui::line(4, "[*] Lines: %lu", (unsigned long)lineCount);
+    if (executing) {
+      ui::bar(5, lineCount / 40.0f, ui::glow(), "exec");
+    }
+
+    for (int i = 0; i < 3; i++) ui::line(7 + i, "%s", msg[i]);
+    if (executing) ui::spinner(228, ui::BODY_Y + 1, ui::glow());
+    ui::hintBar("[t]arget [space]exploit  [`]back");
+  }
+
+private:
+  void say(const char* fmt, ...) {
+    for (int i = 2; i > 0; i--) strncpy(msg[i], msg[i-1], 39);
+    va_list ap; va_start(ap, fmt); vsnprintf(msg[0], 40, fmt, ap); va_end(ap);
+  }
+
+  void executeExploit() {
+    executing = true;
+    lineCount = 0;
+    say("$ Exploit started...");
+  }
+};
+
+Module* makeTerminalEmu() { return new TerminalEmu(); }