24/7/365 threat detection and response across your cloud, identity, endpoints and everything in-between. We got you: https://xitter.cf/t.co/3tlcMwxXMa
USA
Joined February 2014
- Tweets5.9K
- Following1.2K
- Followers30.1K
- Likes4K
Pinned Tweet
Big update for the Red Canary community 🚨
Red Canary is now part of @Zscaler, and going forward, the latest #SecOps insights, updates, and expert perspectives will be shared on @Zscaler channels.
If you’ve followed Red Canary for trusted security content, now’s the time to follow Zscaler for the latest in actionable threat intelligence, detection engineering, and TDIR.
Same mission. Now supercharged with access to trillions of cloud signals giving you more valuable insights to stay ahead.
📆 Follow @Zscaler & register for our upcoming Agentic SecOps Virtual event → lnkd.in/er6bQy5t
#SecurityOperations #ZeroTrustEverywhere #ZeroTrust #AISecurity
Red Canary, a Zscaler company retweeted
Your calendar invites are officially a security risk 🗓️ ⚠️
Tomorrow on SecOps Weekly, Staff Threat Researcher Mitchel Parish will be breaking down the terrifyingly slick world of “platform-chaining” abuse.
The reality: Attackers are ditching the obvious phishing templates. Instead, they’re chaining together legitimate platforms—like Calendly and OneDrive—to trick users into handing over authentication tokens before they even know they're under attack.
It’s a sophisticated bypass of MFA and conditional access that leaves even experienced defenders guessing.
Don’t let adversaries operate in your trusted blind spots.
Register here to join the conversation: bit.ly/4yp44hE
ALT The image is a promotional banner for a SecOps Weekly event on August 25 at 1 PM ET, titled "How platform-chaining abuse leads to phishing." Featured speakers are Mitchell Pariah, a Staff Threat Researcher, and Keith McCammon, VP of Information Security Engineering, both from Zscaler. A "Join Live" button is prominently displayed. The background has abstract shapes and speech bubbles.
Attackers WILL get in eventually.
The goal? Make them trip over themselves before they get too far.
@TimMedin calls it the Home Alone strategy, and when it comes to Kerberoasting, honey tickets are your thumbtacks on the floor. 🏠
📺 Watch the full episode: bit.ly/4bVfzEb
Mac malware is having a moment. 🍎💀
Stealer malware. Backdoors. Adware with teeth. The macOS threat landscape has quietly gotten dangerous, and most teams aren't ready.
Next week on SecOps Weekly, we're sitting down with @ForensicITGuy — one of our resident Mac malware experts — who will be answering YOUR questions live.
What's the one thing you've always wanted to know about Mac malware? Comment below. 👇
🔗 Register for the webcast now: bit.ly/4tMrXgf
🔥 Hot take: One of the most effective privilege escalation techniques is over a decade old and most orgs still aren't fully protected.
Tomorrow, the legendary researcher @TimMedin — who coined the term — joins us on SecOps Weekly to break down why Kerberoasting refuses to die and what you need to do about it.
Still running legacy systems with RC4 encryption? This one's for you.
🔗 Register now for the live webcast: bit.ly/4bbTCjQ
Attackers don't need malware anymore.
They're using legit IT admin tools like ConnectWise, AnyDesk, and Atera to own your environment.
The latest episode of SecOps Weekly breaks down the RMM abuse epidemic and what your SOC should be doing right now.
📺 Watch the full episode: bit.ly/4h14tAK
Why do adversaries love RMM tools so much? Because they’re signed, trusted, and often allowlisted by your security stack 🫠
Attackers aren't just using RMM tools, they’re blending into your environment with persistent, interactive access before dropping secondary payloads like ransomware or infostealers.
And since every RMM tool operates differently, "catching them all" with a single rule is simply not feasible.
Is it hopeless? Absolutely not.
Today @ 1 PM ET, Senior Detection Engineer Jason Killam joins us on SecOps Weekly to tackle the growing problem of RMM abuse and what defenders can do about it.
🔗 Register now for the live webcast: bit.ly/4bbTCjQ
Your July threat briefing is here!
CastleLoader is abusing ClickFix lures and native Windows tools (i.e., finger.exe, curl.exe, Python) to drop various payloads...
And Mac malware is out here pulling new obfuscation tricks.
@techieStef and @ForensicITGuy unpack the July Intelligence Insights—plus some—on the latest episode of SecOps Weekly.
📺 Check out the full epsiode: bit.ly/4gP7Iv1
📖 Read the blog: bit.ly/4wTKp7T
It’s SecOps Weekly day — and today’s episode is hitting different. 👀 🏰
@techieStef and @ForensicITGuy will break down July’s Intelligence Insights, including a brand-new Top 10 newcomer: CastleLoader.
The MaaS loader leveraging ClickFix lures, LOLBins, and encrypted C2 is making moves.
🔗 Register now: bit.ly/4yp44hE
Just because it's there doesn't mean it's authorized. 🤔
LOLBins, certs, signed drivers — attackers hide in plain sight using your OS's native tools.
@ForensicITGuy, @M_haggis & @_josehelps break it all down in the latest SecOps Weekly.
Watch the full episode to find out how defenders can fight back 📺: bit.ly/4vzF6JU
They’re not always dropping malware. Sometimes, they’re just setting up camp 👀 🏕️
Tomorrow on SecOps Weekly, @ForensicITGuy will be joined by @_josehelps & @M_haggis of MagicSword to explore Living Off the Land (LOTL) tradecraft — including LOLBins, LOLScripts, LOLRMM, and other techniques attackers use to hide in plain sight by abusing legitimate tools.
If you defend enterprise environments, this is a conversation you won’t want to miss!
Register now ➡️ bit.ly/4tMrXgf
The “AI event horizon" is here 🌌
Vulnerability reports are surging 100x as AI lowers the skill bar for attackers. @k8em0 sat down with us on SecOps Weekly to explain why parity is our only path forward.
Catch the full episode: youtu.be/POperp9rsxI
🎣 Phishing attacks topped 3.8 million in 2025—and AI is making them harder to catch than ever.
So we built an AI agent to fight back.
Our latest blog breaks down how Red Canary's phishing triage agent blends machine learning, a rules engine, agentic AI, and LLMs into an orchestrated team of specialized subagents, hitting 94% classification accuracy at scale. The future of the SOC isn't AI replacing analysts. It's AI doing the heavy lifting so analysts can focus on what matters most.
Read how we built it → redcanary.com/blog/threat-de…
Tomorrow on SecOps Weekly, @k8em0 joins us to explain why most organizations aren't ready for bug bounty programs and why you should be focusing on configuration issues instead.
Join the conversation live: bit.ly/4tMrXgf
Efficiency in security starts with a proactive mindset.
In this week's episode of SecOps Weekly, @PlexTrac founder Daniel DeCloss breaks down why traditional vulnerability management isn't enough to keep pace with AI and what organizations should be doing instead.
Watch the full video here: bit.ly/4eFZvId
Red Canary, a Zscaler company retweeted
Just wanted to give kudos to how the Zscaler @Threatlabz team have been crushing it recently 🤘
Two awesome blogs caught my eye on novel malware families linked to ransomware gangs:
1. MLTBackdoor zscaler.com/blogs/security-r…
2. Edgecution zscaler.com/blogs/security-r…
Red Canary, a Zscaler company retweeted
🚨 ThreatLabz has discovered a new malware family that we named Edgecution, which is linked to Payouts King ransomware attacks.
Edgecution uses a malicious Microsoft Edge extension to abuse Chrome’s native messaging in order to bypass browser sandbox security and execute arbitrary code.
Read our full technical analysis here: zscaler.com/blogs/security-r…
Attackers are moving at machine speed. Defenders have to keep up. 🏃
Tomorrow, Jun 23, we’re going live on SecOps Weekly with Daniel DeCloss of PlexTrac to discuss how AI is reshaping exposure management, accelerating attacker objectives, and forcing a shift from “find and fix” to continuous mobilization.
Join us! bit.ly/4ekLXl6
For the second month in a row, ClearFake claims the #1 spot on our top 10 most prevalent threats list.🥇
This activity cluster uses injects JavaScript on compromised websites to deliver malware through drive-by downloads—often with fake CAPTCHA lures that trick users into copying and running malicious code.
It’s still one of the most effective initial execution techniques out there, appearing in the delivery and/or execution chain of 7 threats in this month’s top 10. Learn more: bit.ly/4w0ZF2t
Red Canary, a Zscaler company retweeted
Zscaler ThreatLabz observed a ClickFix campaign that leveraged AI to generate a fraudulent website to deliver a new malware family that we named SmartRAT. SmartRAT is written in PowerShell and supports a variety of features including keylogging, taking screenshots, and displaying overlays for banking-related websites.
Read the full technical analysis here: zscaler.com/blogs/security-r…
