TwinLoot Malware Turns Microsoft Cloud into Covert Corporate Backdoor
A newly detailed Python-based implant dubbed TWINLOOT is hijacking Microsoft SharePoint and Teams infrastructure to quietly control compromised Windows systems and steal passwords. By hiding in everyday collaboration tools, the campaign blurs the line between normal cloud traffic and command‑and‑control—posing a direct challenge for enterprises that depend on Microsoft’s stack for sensitive work.
A stealthy hacking tool exploiting Microsoft’s own collaboration services to control infected machines and siphon off credentials is raising fresh alarms about how easily attackers can blend into the cloud traffic that powers modern workplaces.
Security researchers have disclosed that a Python‑based malware family, tracked as TWINLOOT, uses Microsoft SharePoint and Teams components to hide its command‑and‑control (C2) traffic while it steals Windows passwords and opens covert channels into corporate networks. Instead of contacting obvious malicious servers, compromised systems talk to what appear to be legitimate Microsoft endpoints—making it harder for defenders to distinguish attack traffic from everyday collaboration.
According to the technical analysis, the implant pulls tasking from SharePoint, effectively using a victim’s own cloud document infrastructure as a message board for attacker instructions. For interactive access, TWINLOOT abuses Teams’ TURN (Traversal Using Relays around NAT) service, a protocol designed to help real‑time communications traverse firewalls and network address translation. That allows the operators to establish responsive connections to infected machines without raising the kinds of red flags associated with unusual outbound links.
The malware goes further by hijacking the victim’s Edge browser profile to send Graph API requests that appear to originate from normal user activity. Combined with a reverse SOCKS5 tunnel, this setup lets attackers pivot from the initial endpoint into internal systems, using captured credentials to explore and potentially exfiltrate from more sensitive segments of a network.
For organizations heavily invested in Microsoft 365 and Teams, the implications are uncomfortable. The very services that enabled mass remote work and cross‑border collaboration now provide attackers with a ready‑made cloak. Traditional perimeter defenses that rely on IP reputation and domain blocking are of limited use when the malicious traffic is flowing to trusted domains and signed with legitimate tokens.
From the perspective of employees and administrators, the danger is that a compromised account or endpoint can become an invisible beachhead for weeks or months. Password theft from Windows systems not only threatens email and file access but can open paths into finance systems, development environments, and operational technology, depending on how credentials are reused or privileged. A single successful intrusion can therefore cascade into intellectual‑property theft, ransomware staging or quiet manipulation of data.
Strategically, TWINLOOT is part of a broader trend in cyber operations: state‑sponsored and criminal actors alike are moving away from bespoke infrastructure that can be burned and blocked toward abuse of mainstream cloud services that enterprises cannot simply turn off. By weaponizing the business world’s dependence on platforms like SharePoint and Teams, attackers raise the cost and complexity of defense, pushing security teams to invest in far more granular behavioral analytics and identity controls.
The key insight is simple but sobering: in a cloud‑first world, the safest‑looking traffic—the calls your tools make to their own vendors—can carry the sharpest edge. Protecting high‑value data now depends less on building higher walls, and more on spotting the one abnormal request in a sea of legitimate ones.
In the short term, security professionals will be watching for indicators of compromise tied to TWINLOOT, vendor guidance from Microsoft on hardening or monitoring around SharePoint, Teams and Graph usage, and any signs that the toolkit is being adopted beyond its initial operators. How quickly enterprises tune their detection systems to this new kind of camouflage will help determine whether TWINLOOT stays a niche weapon—or becomes a template for the next generation of covert access tools.
Sources
- OSINT