Cybersecurity researchers have uncovered a previously undocumented Python-based malware framework called TWINLOOT, which uses trusted Microsoft services to hide its command-and-control activity. Ontinue’s Cyber Defense Center discovered the implant while investigating an active campaign in July 2026. TWINLOOT uses SharePoint Online, Microsoft Teams, and the victim’s own Microsoft Edge browser as part of its communication infrastructure. This approach can make malicious activity appear similar to normal Microsoft 365 traffic.
TWINLOOT is designed as a modular Python implant and is protected using PyArmor, making analysis more difficult for security teams. Its main command channel operates through SharePoint Online using the Microsoft Graph API, where attackers can leave instructions and receive information from compromised systems. The malware also uses Microsoft Teams TURN servers for interactive communication. At the same time, it can control a headless Edge browser to send Graph API requests through the victim’s own system.
Researchers believe the initial infection begins with social engineering through Microsoft Teams. In the observed activity, an attacker impersonated IT support and convinced a target to execute a PowerShell command. That command downloaded an archive containing a Python runtime and a 39 MB compiled payload named “bootstrap-fat.pyc.” The file then acts as a loader for the TWINLOOT framework, giving the attacker access to the infected Windows machine.
After installation, TWINLOOT creates two separate communication channels from the compromised computer. One channel uses a SharePoint drive as a dead drop, where the malware checks for new commands every 15 seconds through Microsoft Graph. The second channel creates a reverse SOCKS5 tunnel that can provide interactive access to the victim’s internal network. This allows attackers to route connections through the compromised machine while using Microsoft infrastructure to make the activity harder to identify.
The malware can also steal Windows credentials by displaying a fake lock screen to the victim. When the attacker sends the “credz_waiting” command, the screen asks the user to enter their password. The password is not actually checked against Windows authentication, and the malware displays an incorrect-password message regardless of what is entered, potentially encouraging the victim to enter it again. Captured passwords are encrypted and uploaded through the SharePoint channel for later use.
Once credentials are obtained, attackers can use the SOCKS5 tunnel to move deeper into the victim’s network. Researchers observed that connections can reach internal services such as SMB on port 445, RDP on port 3389, WinRM on port 5985, and Microsoft SQL Server on port 1433. From the internal network, these connections can appear to originate from the already compromised computer. The stolen credentials can therefore support lateral movement through services such as Remote Desktop Protocol and WinRM.
TWINLOOT also contains several persistence mechanisms that can help it remain on an infected Windows system. These include a TypeLib COM scriptlet hijack, manipulation of the Windows TaskCache, and a self-update mechanism based on a reobf.json manifest. Another technique uses the open-source Swarmer tool to create stealthy registry keys without requiring administrator privileges. Ontinue said this represents the first recorded malicious use in the wild of this particular persistence method.
The identity of the attackers behind TWINLOOT has not been confirmed, although Ontinue noted similarities with the STAC4749 activity cluster, including Teams-based voice phishing, PyArmor-obfuscated Python malware, SOCKS5 access, and similar persistence techniques. Researchers also highlighted that other malware families have recently abused TURN relay infrastructure, showing a wider interest in hiding malicious traffic inside trusted services. TWINLOOT demonstrates how attackers are increasingly turning legitimate cloud platforms, browsers, and communication systems into covert tools for credential theft, persistence, and movement across enterprise networks.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
