TWINLOOT Malware Abuses SharePoint and Teams to Steal Credentials and Pivot Networks

Cybersecurity researchers have uncovered a new Python-based implant framework called TWINLOOT that abuses trusted Microsoft services for command-and-control (C2) operations. The malware, detailed by Ontinue’s Cyber Defense Center, uses SharePoint Online as a dead-drop for tasking via the Microsoft Graph API and routes interactive access through WebRTC DataChannels relayed by Microsoft Teams TURN servers.

TWINLOOT is a modular, PyArmor-hardened implant that operates its entire C2 infrastructure inside Microsoft services. It leverages a headless instance of the victim’s own Edge browser to ferry Graph API traffic, making malicious activity nearly indistinguishable from legitimate network behavior. The implant is capable of harvesting Windows credentials via pixel-perfect fake lock screens, providing a reverse SOCKS5 pivot into victim networks, executing arbitrary commands, and establishing persistence.

The initial access vector is a social engineering attack via Microsoft Teams, where an attacker posing as IT support persuades a target to run a PowerShell command that downloads an archive containing the Python runtime and a 39 MB compiled payload (bootstrap-fat.pyc). TWINLOOT runs two parallel channels: a SharePoint dead-drop that polls for commands every 15 seconds, and a reverse SOCKS5 tunnel for interactive access and lateral movement. The operator captures credentials via fake lock screens and uses them to pivot to internal hosts via RDP or WinRM.

Persistence is achieved through four methods, including TypeLib COM scriptlet hijack, GhostTask-style TaskCache manipulation, self-update via a reobf.json manifest, and a novel technique using the open-source tool Swarmer to create stealthy registry keys in HKCU without admin privileges. This marks the first recorded malicious use of this persistence method in the wild.

TWINLOOT shares operational parallels with a cluster called STAC4749, known for Teams voice phishing campaigns deploying Chaos ransomware, though the implementation differs substantially. The discovery highlights a growing trend of threat actors abusing TURN relays and headless browsers for C2, following similar techniques seen in Backdoor.Turn and msaRAT.