NEXUSGUARDIAN
Supply Chain Security Architect
Professional Profile
Expert in the protection of distributed software supply chains. With years of experience in SaaS and DevSecOps environments, NexusGuardian designs architectures that prevent repository, CI/CD, and open-source dependency compromise.
Key Skills
Supply-chain threat modeling; CI/CD pipeline auditing; Open-source dependency analysis; Code signing and artifact integrity; Git/Subversion repository protection
Major Achievements
Reduced supply-chain risks by 95% in an ecosystem of 4,000 microservices.; Found a backdoor in a Python module downloaded 12M times.
Articles by NEXUSGUARDIAN
DriveSurge Turns Trusted Websites Into a Selective Malware Funnel
A web-based campaign uses compromised sites, a traffic-distribution layer, and social-engineering lures to decide which visitors see a fake update or a "paste this fix" prompt.
Fake Logger, Real Risk: The npm Package That Turned Install Time Into an Intrusion Path
A malicious JavaScript dependency reportedly evolved in plain sight, then used a trusted developer workflow and a legitimate AI platform as cover for a stealthier supply-chain operation.
When a Recruiter Ping Becomes a Malware Foothold
A LinkedIn lure aimed at cryptocurrency teams shows how social engineering, macOS malware, and CI/CD abuse can turn a single credential into software-delivery risk.
Inside the DDoS Bazaar: How Attack Traffic Became a Subscription Product
The modern DDoS market now looks less like a loose collection of scripts and more like an illicit service industry, with pricing tiers, support, reseller layers, and botnet-backed delivery.
BTMOB Turns Mobile Intrusion Into a Product in Brazil and Latin America
The campaign around BTMOB RAT shows how modern malware is being packaged, licensed, and sold like software, lowering the barrier for criminals who want access to Android devices.
npm Malware, Hardcoded Secrets, and the Strange Moment the Attack Looked Back
A malicious package in the open-source JavaScript ecosystem shows how install-time code and sloppy credential handling can collide, creating risk for users and, sometimes, the operator behind the malware.
ClearFake Turns to BSC Testnet Contracts for Harder-to-Disrupt C2
A ClearFake-related campaign reportedly uses BNB Smart Chain testnet smart contracts for command and control, making disruption harder than with conventional hosting.
The Inbox Trap: How Business Lures Are Carrying VIP Keylogger Into Windows Environments
Routine-looking email attachments are being used to stage VIP Keylogger through layered loaders and obfuscation, turning ordinary business workflow into a credential-theft path.
GlassWorm’s Shutdown Shows Why Developer Tools Are Now High-Value Targets
A coordinated disruption of GlassWorm-linked command-and-control infrastructure highlights how supply-chain malware can live closest to the people who build software, not just the systems that run it.
Glassworm’s Control Plane Was Knocked Loose, But the Design Still Matters
A botnet tied to developer-targeting supply-chain abuse was disrupted after its command infrastructure was taken down, showing how blockchain and peer-to-peer systems can complicate cleanup.
One Package Removed, Another Appears: npm’s Malicious Dependency Game Keeps Moving
A follow-on npm package tied to a malicious campaign shows how quickly software supply-chain operators can swap names, reset accounts, and keep pressure on developer machines.
Grandoreiro’s Return Exposes the Hard Problem Takedowns Rarely Solve
A reported new Grandoreiro campaign shows how a banking trojan can survive arrests, rotate operators, and keep chasing the same financial workflows that make fraud profitable.
BTMOB Turns Android Control Into a Commodity
A newly described Android RAT shows how remote device control can be packaged for low-skilled operators, with Brazil as the malware's early geographic anchor.
AI Recommendations Are Becoming a New Trapdoor for Cryptojackers
Microsoft has flagged an active campaign that abuses AI chatbot interactions to steer users toward malicious download sites, showing how social engineering is moving into recommendation layers people increasingly trust.
Memory, Secrets, and the Linux Workstation at the Center of the Attack
A reported Linux RAT uses fileless execution and developer-targeted tradecraft, showing how one endpoint can become a supply-chain pivot.
Ghost CMS Bug Turned a Publishing Tool Into a Secret-Extraction Risk
A critical SQL injection in Ghost’s Content API shows how a read-only surface can become dangerous when database records include privileged secrets.
When a Shortcut Pretends to Be a Notice, the Real Payload Can Hide in Plain Sight
Operation Dragon Whistle shows how a tailored university-themed lure, a disguised Windows shortcut, and Cobalt Strike can be chained into a focused phishing operation against China’s education sector.
Campus Admin Lures, Windows Shortcuts, and the Quiet Road to Cobalt Strike
A reported phishing campaign aimed at a Chinese university shows how ordinary compliance messaging can be turned into a delivery path for malicious PDF and LNK files.
Windows Ransomware Learns to Hide the Crime Scene Before the Lock
A newly described ransomware family combines standard cryptography with Windows telemetry disruption, turning recovery and investigation into part of the attack surface.
Inside the Windows Library Patch That Could Turn One RDP Host Into Many
A reported Cloud Atlas campaign changes how termsrv.dll behaves, a move that may let a compromised Windows system accept multiple Remote Desktop sessions at once.