NEXUSGUARDIAN
Architecte de sécurité de la supply chain
Profil professionnel
Expert dans la protection des chaînes d’approvisionnement logicielle distribuées. Fort de nombreuses années d’expérience dans les environnements SaaS et DevSecOps, NexusGuardian conçoit des architectures qui empêchent la compromission des dépôts, de CI/CD et des dépendances open source.
Compétences clés
Modélisation des menaces de supply chain; audit des pipelines CI/CD; analyse des dépendances open source; signature de code et intégrité des artefacts; protection des dépôts Git/Subversion
Réalisations majeures
Réduction des risques de supply chain de 95 % dans un écosystème de 4 000 microservices.; découverte d’une backdoor dans un module Python téléchargé 12 M de fois.
Articles de NEXUSGUARDIAN
Fake Zoom Installer, Real macOS Trap: CloudSyncD Uses Trust and Invisible Text to Hide in Plain Sight
A Zoom-branded lure, a password prompt, and zero-width Unicode show how attackers can turn routine macOS installation steps into a stealthy credential and backdoor operation.
CloudSyncD and the Password Hidden Where Reviewers Least Expect It
A macOS backdoor tied to a fake Zoom disk image shows how brand impersonation and invisible Unicode can turn a plain text config file into a covert hiding place.
TerminalFix Turns a User Click Into a Hidden Network Relay
The TerminalFix campaign combines ClickFix-style social engineering, PowerShell, DLL sideloading, and a Python reverse tunnel to build covert command-and-control channels inside targeted networks.
When the Loader Lies First: 2CLoader and the New Evasion Layer
A Windows loader observed by researchers uses encrypted payloads, anti-analysis checks, and syscall-level tricks to help deliver commodity stealers and a remote-access trojan.
2CLoader Turns Windows Into a Moving Target for Stealers and RATs
A reusable Windows loader is drawing attention for anti-VM checks, indirect syscalls, and API tampering that can help it stage Vidar, Remus, and XWorm while staying harder to inspect.
The Quiet Windows Trick Behind a Phishing Chain Built for Persistence
RedFlick pairs password-protected archives with scheduled tasks to deliver CosmicPulse, a backdoor Microsoft describes as part of a broader phishing and malware-delivery operation.
Inside the Fake Software Folder: How a Windows RAT Blends Into Trust
A concealed .NET remote access trojan tied to SectopRAT shows how attackers can hide control malware inside a legitimate-looking software directory while targeting browser data, passwords, cards, and crypto wallets.
The Installer Became the Hiding Place: OpenSUpdater’s 7-Zip Trick
A malware family is being tucked into recompiled 7-Zip self-extracting installers, shifting the fight from the payload alone to the code that unpacks it.
When the Wallet Becomes the Beacon: Ethereum Seen as a Malware Recovery Channel
A reported technique called HashHiding turns an ordinary Ethereum recipient address into a compact recovery signal for malware, raising the bar for takedown and detection.
x47.c and the New Economics of Botnet Abuse
A newly identified Windows botnet mixes familiar malware tradecraft with an unusual AI API-drain capability that could turn stolen access into direct service spend.
NeedyMantis and the Art of Staying Hidden After the Breach
A modular malware framework with a custom file format shows how intruders can turn ordinary software paths into long-lived footholds.
NeedyMantis Turns a Breach Into a Quiet Occupation
Microsoft-linked threat research points to a modular malware framework that arrives after access is already stolen, then helps attackers stay hidden, communicate covertly, and extend control inside sensitive networks.
When Malware Starts Speaking in Blockchain Transfers
A reported malware campaign is using Ethereum activity as a hidden signaling layer, a reminder that public ledgers can be repurposed as a covert control channel.
NeedyMantis and the New Logic of Stealth: Malware Built to Stay, Not Just to Break In
A modular Windows framework is drawing attention because it appears designed to preserve access after compromise, turning trusted software behavior into a long-lived intrusion layer.
When a Docker Control Plane Becomes a Botnet Console
A reported campaign used exposed Docker management ports, a legitimate open-source agent, and common tunneling tools to turn container servers into remotely steered assets.
When a Trusted Action Comes Back Wrong: The Quiet Persistence Problem in GitHub CI
Two third-party GitHub Actions were re-enabled after a prior compromise, but the real danger was not the restart - it was that the automation path still pointed at malicious code.
x47.c and the New Face of Botnet Abuse: AI as an Operational Tool and a Cost Target
The reported Windows botnet uses xAI Grok to choose from predefined actions and maintain persistence, while the phrase "AI API draining" points to a broader abuse pattern that can turn valid API usage into a financial sink.
Two GitHub Actions Went Dark, Came Back, and Started Running Malware Again
A brief return of access to two actions-cool repositories was enough for Mini Shai-Hulud code to reappear inside GitHub Actions workflows.
The Loader That Starts With a Lie: How Sauron Turns Conversation Into Code Execution
A newly identified malware loader linked to attacks in Germany shows how ClickFix-style prompts and voice phishing can turn human trust into an execution path.
When a Malware Loader Stops Trusting Domains, Takedowns Lose Their Grip
AvisLoader combines a ClickFix-style lure, an exposed staging server, and Tox-based command traffic, making simple website takedowns a weaker defensive answer.