Bottom line: TWINLOOT abuses SharePoint, Teams TURN, and the victim’s own Edge instance as command-and-control channels within legitimate Microsoft infrastructure, thereby evading detection systems that blanket-trust Microsoft traffic.
Security researchers at the Ontinue Cyber Defense Center have discovered a Python malware framework called TWINLOOT that uses SharePoint Online, Microsoft Teams, and the victim’s Edge browser instance for its command-and-control communication. Because the traffic stays within legitimate Microsoft infrastructure, the malware evades classic detection mechanisms that classify Microsoft traffic as trustworthy by default.
Ontinue discovered the implant in July 2025 while investigating an active campaign. TWINLOOT uses SharePoint Online as a file-based dead drop, polling a drive roughly every 15 seconds to receive commands and exfiltrate stolen credentials and reconnaissance data. For interactive access, the malware establishes a reverse SOCKS5 tunnel over Microsoft Teams’ TURN infrastructure — only the second known case of Teams TURN abuse observed in the wild, and, according to Ontinue, the first to use genuine WebRTC data channels. In parallel, the implant launches a headless instance of the victim’s Edge browser, attaches to it via the Chrome DevTools Protocol, and sends Microsoft Graph API requests as “same-origin fetch()” calls, so that the network traffic appears to originate from a legitimate Edge process. Authentication is performed against an Azure tenant controlled by the attackers rather than the victim’s Microsoft 365 environment, meaning no authentication or audit events appear in the victim’s Entra ID logs.
For CISOs, TWINLOOT undermines a fundamental detection assumption: traffic to Microsoft IP ranges is treated as benign by default in many detection stacks, because no attacker-controlled domain name appears in the communication path. Shane Barney, CISO at Keeper Security, describes the problem as traffic that looks exactly as it should look, which is why most detection tools leave it untouched. Robert Coles, Senior Manager Threat Intelligence Security at Black Duck, frames this as part of a broader trend in which attackers increasingly rely on trusted cloud services instead of their own infrastructure. He recommends focusing on behavioral detection, identity monitoring, and anomaly detection — particularly around unusual Graph API activity, OAuth applications and consent grants, as well as anomalous SharePoint and Teams behavior.
On command, TWINLOOT displays a fake Windows 10 or Windows 11 lock screen showing the victim’s real account details. The password entered is never validated; instead, every input attempt is intercepted, encrypted, and exfiltrated via the SharePoint C2 channel, while the victim sees an innocuous error message before the login ultimately succeeds. The credentials captured this way can be used via the reverse SOCKS tunnel for lateral movement, for example through RDP, SMB, or WinRM access. Additionally, the malware uses a persistence technique Ontinue says has been observed in the wild for the first time, called “Corrupting the Hive Mind”: this creates a Windows “NTUSER.MAN” mandatory profile hive offline, which requires no administrator privileges and triggers no registry modification event.
For defenders, this means that pure network- and domain-based detection is ineffective against TWINLOOT. Security teams should check SharePoint access patterns, Teams TURN connections, and Graph API calls for anomalies, regularly audit OAuth consent grants, and monitor the process behavior of Edge instances making unusual API calls. At the time of publication, Microsoft had not yet responded to a request for comment from CSO.
Source: www.csoonline.com · Published August 18, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.