TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Severity
High

Detail

Cybersecurity researchers have identified a previously undocumented Python-based malware framework called TWINLOOT that abuses legitimate Microsoft services, including SharePoint Online and Microsoft Teams, for command-and-control (C2) communication and lateral movement.

TWINLOOT uses SharePoint Online through the Microsoft Graph API to receive commands and exfiltrate data, while Microsoft Teams TURN servers can be abused to establish interactive communication with compromised systems. The malware also uses the victim’s Microsoft Edge browser in headless mode to make its SharePoint communications appear like legitimate Microsoft traffic.

The malware was discovered during an investigation into an ongoing campaign in July 2026. The initial access is believed to involve social engineering through Microsoft Teams, where attackers impersonate IT support personnel and persuade victims to execute a malicious PowerShell command.

How?

TWINLOOT initially gains access through Teams-based social engineering. The attacker masquerades as IT support and convinces the victim to execute a PowerShell command that downloads an archive containing the Python runtime and a compiled TWINLOOT payload.

Once executed, the malware establishes multiple C2 channels using trusted Microsoft services. It communicates with an attacker-controlled SharePoint Online drive through the Microsoft Graph API and polls the drive for commands approximately every 15 seconds. The malware uses the victim’s Edge browser in headless mode to communicate with Microsoft services, making the traffic more difficult to distinguish from legitimate activity.

TWINLOOT also establishes a reverse SOCKS5 tunnel that provides attackers with interactive access to the compromised environment. The tunnel can use Microsoft Teams TURN infrastructure and allows attackers to proxy connections into the victim’s internal network, including SMB, RDP, WinRM, and MSSQL services. This can enable credential abuse and lateral movement to additional systems. The malware can steal Windows credentials by displaying a fake Windows lock screen. Captured passwords are encrypted and uploaded through the SharePoint communication channel, after which attackers can use the credentials through the SOCKS5 tunnel to access other systems.

TWINLOOT also supports arbitrary command execution, reconnaissance, discovery, screenshot capture, and multiple persistence mechanisms. These include COM scriptlet hijacking, TaskCache manipulation, and stealthy registry-based persistence. The use of legitimate Microsoft services for C2 makes traditional network-based detection more challenging, as malicious communications can blend into normal Microsoft 365 traffic. The combination of credential theft, SOCKS5 tunneling, and lateral movement can allow attackers to progress from a compromised endpoint into the wider internal network.

Recommendation

Organizations should implement a layered security approach to reduce the risk of TWINLOOT and similar attacks:

• Educate users to verify unexpected Microsoft Teams support requests and avoid executing PowerShell commands provided through chat or calls.
• Monitor PowerShell activity for suspicious commands that download and execute files from untrusted sources.
• Monitor Microsoft 365 and endpoint logs for unusual SharePoint, Graph API, Teams, and browser activity.
• Monitor for unexpected SOCKS5 connections and unusual internal connections from user workstations to SMB, RDP, WinRM, and MSSQL services.
• Enable and maintain endpoint detection and response (EDR) to identify suspicious Python processes, headless browsers, credential theft, and persistence mechanisms.
• Enforce least privilege and MFA to reduce the impact of stolen Windows credentials.

Source

https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html