A newly uncovered Python-based malware framework dubbed TWINLOOT is turning Microsoft 365 into its command-and-control backbone, abusing trusted cloud services such as SharePoint Online and Microsoft Teams to hide in plain sight.[1][2][3] Researchers at Ontinue’s Cyber Defense Center say the implant routes most of its C2 activity through Microsoft-owned infrastructure, making malicious traffic difficult to distinguish from everyday enterprise use.[1][2]
Ontinue describes TWINLOOT as a modular, PyArmor-hardened Python implant designed to operate entirely inside trusted Microsoft services rather than traditional attacker-controlled servers.[2] Tasking and data exfiltration flow through SharePoint Online “dead drop” files accessed via the Microsoft Graph API, driven by a headless instance of the victim’s own Edge browser so that outbound traffic appears as legitimate Microsoft 365 activity terminating in Microsoft IP space.[1][2] The framework includes capabilities to execute arbitrary commands, establish persistence, provide a reverse SOCKS5 pivot into internal networks, and harvest Windows credentials.[2][4]
The credential theft component of TWINLOOT relies on pixel-perfect fake Windows lock screens that trick users into re-entering passwords, which are then captured by the implant.[2] Once a foothold is established, the malware can spin up a reverse SOCKS5 tunnel over either a direct TLS/WebSocket connection to an attacker-controlled server or via Teams’ TURN WebRTC relay infrastructure, giving operators interactive access for lateral movement across victim environments.[2][4] By blending these channels under a single framework, TWINLOOT extends living-off-the-land techniques into what is effectively living-off-the-cloud.[2]
Initial access in observed campaigns is assessed to come from social engineering over Microsoft Teams, where a threat actor masquerading as IT support convinces targets to run a PowerShell command.[2] That command downloads an archive containing a bundled Python runtime and a 39 MB compiled payload, bootstrap-fat.pyc, which serves as the loader for the main TWINLOOT implant.[2] Ontinue’s analysis notes that the actor behind the campaign demonstrates deep familiarity with both offensive tradecraft and Microsoft’s cloud architecture, though no public attribution has been made.[2]
Because TWINLOOT abuses legitimate Microsoft cloud services rather than exploiting a specific product vulnerability, there is no dedicated CVE or patch that eliminates the threat.[1][2] Instead, the risk stems from how extensively many organizations rely on Microsoft 365 and Teams, where high volumes of Graph API and WebRTC traffic are expected and often under-monitored.[1][3] Traditional perimeter defenses and domain-based C2 blocking are less effective when malicious communications are embedded within sanctioned SaaS traffic bound for Microsoft tenants.[1][2]
Defenders are urged to compensate with tighter monitoring and hardening around Microsoft 365 and Teams, including closer inspection of Graph API usage patterns, SharePoint file activity, and external Teams interactions. Security teams should hunt for unusual Edge browser instances being launched in headless mode, restrict or closely audit high-risk PowerShell execution, and apply granular access controls for external collaboration. As Ontinue warns that TWINLOOT is the first publicly documented tool to combine Microsoft 365 dead-drop C2, Teams TURN relay abuse, and headless browser transport in one package, organizations should expect copycats and evolutions of the technique to follow.[1][2]
References
- New malware turns Microsoft cloud into its control center
- TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
- News | Computerworld
- Guavy Wire – Live market news and analysis
