TWINLOOT Malware Abuses SharePoint & Teams for Stealth C2

Cybersecurity researchers at Ontinue have uncovered a previously undocumented Python implant framework dubbed TWINLOOT that weaponizes trusted Microsoft services to run its entire command-and-control infrastructure inside Microsoft 365. Detected by Ontinue's Cyber Defense Center in July 2026 during an active intrusion investigation, TWINLOOT is a modular, PyArmor-hardened implant that uses SharePoint Online file dead-drops via the Microsoft Graph API for tasking and routes interactive operator access through WebRTC DataChannels relayed by Microsoft Teams TURN servers. All Graph API traffic is driven by a headless instance of the victim's own Edge browser, making the activity nearly indistinguishable from legitimate network behavior.

The malware is capable of harvesting Windows credentials through pixel-perfect fake lock screens, offering a reverse SOCKS5 pivot into victim networks, executing arbitrary commands, and establishing host persistence. Defenders should run a password strength check on all privileged accounts and audit browser fingerprinting anomalies caused by silent headless Edge instances. TWINLOOT runs two parallel channels from a compromised host: a SharePoint dead drop that authenticates to an attacker's Azure tenant and polls a SharePoint drive every 15 seconds for new commands, and a reverse SOCKS5 tunnel—either over direct TLS/WebSocket or via the Teams TURN WebRTC relay—through which the operator proxies traffic into the victim's internal network, exiting from pythonw.exe to ports like 445 (SMB), 3389 (RDP), 5985 (WinRM), and 1433 (MSSQL).

The initial access vector is assessed to be a social engineering attack via Microsoft Teams, in which a threat actor posing as IT support convinced a target to run a PowerShell command that downloaded an archive containing a Python runtime and a 39 MB compiled payload (bootstrap-fat.pyc) acting as the TWINLOOT loader. Ontinue described the threat actor as highly knowledgeable in offensive tradecraft and Microsoft cloud architecture, noting that TWINLOOT is the first known framework to combine Microsoft 365 dead-drop C2, Teams TURN relay abuse, and headless browser transport under a single umbrella.

Because TWINLOOT blends into normal Microsoft 365 traffic and pivots through trusted services, traditional perimeter defenses are largely blind to it. Security teams are advised to monitor for anomalous Edge browser child processes spawning pythonw.exe, unexpected Teams TURN relay usage from corporate endpoints, and SharePoint drives receiving unusually high-volume polling activity. Network defenders should also scan internal ports exposed on compromised hosts using a port scanner to identify lateral movement paths before the operator establishes a persistent foothold.