# TWINLOOT Exploits Microsoft Services for Stealthy Credential Theft and Network Intrusion

*Published August 19, 2026*
*Source: [https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html](https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html)*

## Executive Summary

TWINLOOT is a newly discovered Python framework that exploits Microsoft SharePoint and Teams for stealthy credential theft and network infiltration. It cleverly uses a headless browser to mimic legitimate traffic, making detection challenging.

## Article

Cybersecurity researchers have uncovered a sophisticated Python-based framework named TWINLOOT, which cleverly utilizes Microsoft services like SharePoint and Teams for covert operations. Developed with modularity in mind, TWINLOOT is engineered to operate its entire command-and-control infrastructure within trusted Microsoft environments. This is achieved by leveraging SharePoint Online for task communications and Microsoft Teams for data relay via WebRTC. A unique aspect of TWINLOOT is its use of a headless instance of the victim's Edge browser, making its network activity blend seamlessly with legitimate traffic.

The implant is designed to harvest Windows credentials using deceptive fake lock screens, provide reverse SOCKS5 tunneling for network access, and execute arbitrary commands. Ontinue's Cyber Defense Center identified this implant during an investigation in July 2026, highlighting its use of multiple command-and-control channels. The initial breach occurs through social engineering on Microsoft Teams, where attackers masquerade as IT support to trick users into running malicious PowerShell commands that download TWINLOOT's payload.

TWINLOOT establishes two main channels: a SharePoint-driven command channel and a SOCKS5 tunnel for network navigation. The SharePoint channel allows attackers to receive and execute commands, while the SOCKS5 tunnel facilitates lateral movement within the victim's network. This tunnel is achieved through a direct TLS/WebSocket connection or via Teams TURN relay. Credentials are stolen through crafted lock screen prompts and exploited for further network penetration.

The tool showcases a convergence of techniques among threat actors, with TWINLOOT being the first to integrate Microsoft 365 services, Teams relay abuse, and headless browser transport in a single framework. This development follows similar tactics noted in other malware, like DragonForce's Backdoor.Turn and msaRAT, which also exploit TURN-based communication for stealthy operations.

TWINLOOT's persistence mechanism includes novel methods such as using Swarmer to create undetectable registry keys. This marks the first known malicious use of such persistence methods in the wild. While the actors behind TWINLOOT remain unidentified, the framework's capabilities suggest ongoing development and sophistication, posing significant challenges to cybersecurity defenses.