SHADOWFIREWALL
Arquitecto de defensa adaptativa
Perfil profesional
ShadowFirewall crea firewalls de comportamiento basados en modelos de patrones hostiles. Con formación en IA y sistemas embebidos, diseña defensas reactivas que aprenden del tráfico.
Competencias clave
Firewalls adaptativos; modelado de comportamiento hostil; detección de anomalías; microsegmentación; seguridad OT/SCADA
Logros principales
Diseñó el primer firewall de comportamiento de una fábrica inteligente europea.
Artículos de SHADOWFIREWALL
Salesforce Trust Becomes the Breach Path in a Long-Running Theft Pattern
Microsoft mapped a year-long campaign tied to ShinyHunters-linked activity that appears to have moved through OAuth trust rather than a Salesforce platform flaw.
OAuth Trust Turns Into a Quiet Salesforce Standoff
Microsoft warned that ShinyHunters-linked tradecraft may be using trusted OAuth relationships to keep Salesforce access alive while bypassing ordinary sign-in checks.
Italy’s New Delegation Model Tries to Kill Password Sharing in Public Services
A formal digital proxy system for public-administration access shifts trust from informal help to regulated authorization, but the security value depends on identity assurance, revocation, and careful implementation.
When a Trusted App Becomes the Breach Path
A Salesforce OAuth trust relationship can outlive the login that created it, letting attackers move through CRM data without repeatedly facing MFA.
Progress Pulls the Brakes on ShareFile Accounts After a Threat Hits the Controller Layer
A preventive account disablement around ShareFile’s Storage Zones Controllers shows how a cloud file service can choose isolation over certainty when a trust boundary comes under pressure.
A Beach-Themed CTF Is Teaching Defenders How Identity Attacks Hide in Plain Sight
Varonis has turned Entra ID into a training ground, showing how cloud identity investigation depends on reading logs, policy signals, and account behavior with forensic discipline.
When Identity Logs Go Dark, Entra Reconnaissance Gets Harder to Spot
A Microsoft Entra user-enumeration trick is raising concern because it appears to blur the telemetry defenders use to separate routine login noise from account-hunting activity.
AI Recon Is Quietly Mapping the New Cloud Attack Surface
Log reviews from a low-traffic host show probes for MCP, assistant configs, and exposed LLM endpoints, a pattern that matters most when it can be chained into classic SSRF and cloud-token risk.
Progress Pulls the Brake on ShareFile Edge Servers as a Credible Threat Emerges
The shutdown request is a reminder that in hybrid SaaS, the risky part may be the customer-managed server sitting beside the cloud service.
Poisoned npm Update Turns a Security Tool Into a Secret Grabber
A malicious jscrambler release in npm shows how one compromised publish path can put developer workstations and CI jobs in the crosshairs of cloud and source-control secrets.
One Open Directory, a Whole Phishing Operation: The Server That Exposed a Microsoft 365 Token Playbook
A publicly reachable file server in Budapest surfaced working materials linked to a live phishing operation, showing how session theft can matter more than passwords in Microsoft 365 attacks.
GovCloud Credentials in a Public Repo: The Leak That Exposes Cloud Identity, Not Just Code
CISA’s disclosure of an internal incident tied to AWS GovCloud credentials in a public repository is a reminder that the most sensitive cloud failures often begin with simple secret handling mistakes.
When the AI Gateway Becomes the Prize
A cryptomining incident is a reminder that a gateway built to simplify AI access can also concentrate risk across models, cloud infrastructure, and IAM data.
When a Mailbox Becomes an API Problem
A targeted campaign tied to ToddyCat shows how malware, installer lures, and cloud authorization abuse can turn Gmail from an inbox into an identity-risk surface.
Why a $2.9 Million Identity Bet Says More About Security Priorities Than Startup Money
8Layers’ extended pre-seed round is a small financing headline with a larger technical signal: buyers are still looking for better ways to see, score, and govern identity risk before attackers do.
Passkeys Shift the Battle Line: Attackers Move From Password Dumps to Verification Flaws
As password replay loses value in well-implemented passkey environments, account takeover pressure is migrating toward verification, recovery, and fallback paths that still decide who gets in.
The Real Microsoft Login That Handed Criminals a Session
A phishing kit called EvilTokens shows how attackers can abuse a legitimate OAuth path to collect valid Microsoft 365 tokens without stealing a password.
When a Preview Becomes a Breach Path: The Writer AI Session Leak Risk
A now-patched flaw in an enterprise AI workspace shows how a seemingly harmless preview layer can turn into a tenant-boundary problem if session handling slips.
The Hidden Identity Layer Powering AI: Why Machines Are Becoming the Hardest Users to Govern
A security article published on 2026-07-06 puts Non-Human Identities and AI agents in the spotlight, but the deeper issue is bigger: machine access is now a governance problem, not just a credential problem.
When the Login Page Is Real: The Device-Code Phishing Playbook Targeting Microsoft Accounts
A legitimate Microsoft sign-in path built for low-input devices is being repurposed as a phishing lure, shifting the attack from password theft to trusted-session abuse.