TwinLoot Hides Its Control Channel in Microsoft 365
Ontinue found an ongoing July 2026 campaign built around TwinLoot, a previously undocumented Python implant that turns Microsoft 365 services into its command path. It uses SharePoint Online, Microsoft Graph, Microsoft Teams TURN relays, and the victim’s own Edge browser to move tasks and operator traffic.
The implant polls SharePoint for commands, routes interactive access through Teams, and uses a headless Edge session to make Graph traffic look like ordinary Microsoft cloud activity. That lets it steal Windows credentials, run commands, maintain persistence, and open a SOCKS5 pivot into the victim network while avoiding the usual perimeter view.
For Microsoft 365-heavy environments, the exposure sits in cloud and identity telemetry as much as in network logs. If Teams, SharePoint, or Graph traffic is treated as trusted by default, an active intrusion can blend in while it is still being tasked and extended laterally.