New TWINLOOT Malware Abuses SharePoint and Teams for Stealthy Command-and-Control

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. According to a technical report from Ontinue shared with The Hacker News, TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services. Tasking flows through SharePoint Online file storage, while Microsoft Teams is used for C2 communication, allowing the malware to blend in with legitimate organizational traffic.

The use of trusted platforms like SharePoint and Teams makes detection particularly challenging, as security tools often whitelist these services. The malware's modular design enables attackers to deploy additional components for credential theft and lateral movement across networks. Ontinue's report highlights that the implant leverages these services to evade traditional network-based detection mechanisms.

While the exact victim count and scale of the campaign have not been specified, the disclosure underscores a growing trend of attackers abusing legitimate cloud services to host malicious infrastructure. Organizations using Microsoft 365 should be aware of this threat and review their security posture accordingly.

As of the publication date, no CVE identifiers have been associated with TWINLOOT, and no specific patch is available. Mitigation focuses on monitoring for anomalous activity within SharePoint and Teams, implementing least-privilege access controls, and reviewing indicators of compromise provided by Ontinue. Organizations are advised to enable detailed logging and audit trails for these services to detect suspicious file uploads or unusual Teams activity.

The report does not provide confirmed attribution to any specific threat actor, and the exact exploit sequences remain unverified. Security teams should treat this as a reported threat and validate any findings against their own environments.