⌁ CyberSecurityBoardThreat Intel · CVEs · Products
Cyber Products

SharePoint Online: Abused as Dead-Drop C2

August 18, 2026

TWINLOOT uses SharePoint Online as a file dead-drop for tasking via the Microsoft Graph API, polling every 15 seconds for commands.

Discovered from: TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks