SHADOWFIREWALL
Architecte de défense adaptative
Profil professionnel
ShadowFirewall crée des pare-feu comportementaux fondés sur des modèles de comportements hostiles. Avec une expérience en IA et en systèmes embarqués, il conçoit des défenses réactives qui apprennent du trafic.
Compétences clés
Pare-feu adaptatifs; modélisation des comportements hostiles; détection d’anomalies; micro-segmentation; sécurité OT/SCADA
Réalisations majeures
Conception du premier pare-feu comportemental d’une usine intelligente européenne.
Articles de SHADOWFIREWALL
Healthcare’s Quiet Weak Spot Is Not a Hack - It Is the Gaps Between Vendors, Logins, and Practice
A new healthcare warning puts supply-chain security, identity management, and staff readiness in the same frame: cyber risk becomes operational risk when hospitals cannot trust who connects, who updates, or who responds.
When Fake App IDs Become Noise: The OAuth Trick That Can Blur Entra ID Defenses
A credential attack that rotates through fictional OAuth client identities does not break encryption - it tries to break the defender’s ability to see a pattern.
Microsoft’s Entra Identity Turns Toward Passkeys, and the Fallback Problem Gets Real
Microsoft has set passkeys to become the default authentication method for Entra ID in September 2026, a change that shifts the security conversation from passwords to enrollment, recovery, and policy design.
AI Coding Tools Can Leak the Whole Repo, Not Just the Prompt
A Grok Build test exposed a deeper risk in AI-assisted coding: separate storage channels can move repository history and tracked secrets even when the model itself sees only a tiny slice of traffic.
When a Coding Agent Sends the Whole Repo, the Cloud Becomes the Risk
A repository-scoping failure in Grok Build shows how an AI coding tool can turn a simple task into a much larger data-movement problem.
When a Fake App Name Becomes a Cloak: The Entra Campaign Hiding Behind OAuth Noise
Spoofed OAuth client IDs are giving attackers a way to probe Microsoft Entra accounts while making their activity look like ordinary sign-in churn.
Salesforce Trust Becomes the Breach Path in a Long-Running Theft Pattern
Microsoft mapped a year-long campaign tied to ShinyHunters-linked activity that appears to have moved through OAuth trust rather than a Salesforce platform flaw.
OAuth Trust Turns Into a Quiet Salesforce Standoff
Microsoft warned that ShinyHunters-linked tradecraft may be using trusted OAuth relationships to keep Salesforce access alive while bypassing ordinary sign-in checks.
Italy’s New Delegation Model Tries to Kill Password Sharing in Public Services
A formal digital proxy system for public-administration access shifts trust from informal help to regulated authorization, but the security value depends on identity assurance, revocation, and careful implementation.
When a Trusted App Becomes the Breach Path
A Salesforce OAuth trust relationship can outlive the login that created it, letting attackers move through CRM data without repeatedly facing MFA.
Progress Pulls the Brakes on ShareFile Accounts After a Threat Hits the Controller Layer
A preventive account disablement around ShareFile’s Storage Zones Controllers shows how a cloud file service can choose isolation over certainty when a trust boundary comes under pressure.
A Beach-Themed CTF Is Teaching Defenders How Identity Attacks Hide in Plain Sight
Varonis has turned Entra ID into a training ground, showing how cloud identity investigation depends on reading logs, policy signals, and account behavior with forensic discipline.
When Identity Logs Go Dark, Entra Reconnaissance Gets Harder to Spot
A Microsoft Entra user-enumeration trick is raising concern because it appears to blur the telemetry defenders use to separate routine login noise from account-hunting activity.
AI Recon Is Quietly Mapping the New Cloud Attack Surface
Log reviews from a low-traffic host show probes for MCP, assistant configs, and exposed LLM endpoints, a pattern that matters most when it can be chained into classic SSRF and cloud-token risk.
Progress Pulls the Brake on ShareFile Edge Servers as a Credible Threat Emerges
The shutdown request is a reminder that in hybrid SaaS, the risky part may be the customer-managed server sitting beside the cloud service.
Poisoned npm Update Turns a Security Tool Into a Secret Grabber
A malicious jscrambler release in npm shows how one compromised publish path can put developer workstations and CI jobs in the crosshairs of cloud and source-control secrets.
One Open Directory, a Whole Phishing Operation: The Server That Exposed a Microsoft 365 Token Playbook
A publicly reachable file server in Budapest surfaced working materials linked to a live phishing operation, showing how session theft can matter more than passwords in Microsoft 365 attacks.
GovCloud Credentials in a Public Repo: The Leak That Exposes Cloud Identity, Not Just Code
CISA’s disclosure of an internal incident tied to AWS GovCloud credentials in a public repository is a reminder that the most sensitive cloud failures often begin with simple secret handling mistakes.
When the AI Gateway Becomes the Prize
A cryptomining incident is a reminder that a gateway built to simplify AI access can also concentrate risk across models, cloud infrastructure, and IAM data.
When a Mailbox Becomes an API Problem
A targeted campaign tied to ToddyCat shows how malware, installer lures, and cloud authorization abuse can turn Gmail from an inbox into an identity-risk surface.