Bottom line: The newly discovered Python implant TWINLOOT uses SharePoint Online and Microsoft Teams as complete command-and-control infrastructure, thereby bypassing classic network-based detection mechanisms.
Security researchers at Ontinue have identified a previously undocumented Python implant named TWINLOOT that operates its entire command-and-control infrastructure within trusted Microsoft services. For defenders, this means that classic network indicators such as suspicious external IP addresses or unknown domains are largely eliminated as detection features.
According to Ontinue, TWINLOOT is a modular Python implant hardened with PyArmor. This hardening significantly complicates static analysis and reverse engineering of the malicious code, as PyArmor encrypts Python bytecode and decrypts it at runtime. The real twist, however, lies in the command structure: control of infected systems runs via SharePoint Online files, while additional communication channels are handled through Microsoft Teams. The Ontinue report does not provide specific technical details on transmission formats, the API endpoints used, or affected versions at this point.
For CISOs, the relevance is immediate: attacks that operate entirely within legitimate Microsoft 365 services undermine many classic network-based detection mechanisms. Traffic to SharePoint Online and Teams is classified as trustworthy in most enterprise environments and is rarely inspected or blocked in depth. As a result, command-and-control traffic can disappear into seemingly normal business traffic, making attack detection more difficult and potentially extending an attacker’s dwell time within the network.
From an operational perspective, security teams should adjust their detection strategy accordingly: rather than relying solely on IP- and domain-based indicators, behavior-based monitoring of SharePoint and Teams activity is recommended, such as unusual file access patterns, atypical API calls, or conspicuous usage times. In addition, organizations should verify whether their existing EDR and SIEM rules adequately cover Microsoft 365 telemetry to detect early abuse of trusted cloud services as a C2 channel.
Source: thehackernews.com · Published August 18, 2026
Lumi AI News — AI-assisted curation pursuant to Art. 50 EU AI Act. Paraphrasing and classification by Lumi News Pipeline v1.8.3.