TWINLOOT Uses SharePoint, Teams and Edge for Covert Network Access

Ontinue has disclosed TWINLOOT, a previously undocumented, modular Python implant found during an investigation into an active campaign in July 2026. The PyArmor-hardened framework uses SharePoint Online for command tasking, Microsoft Teams TURN servers for interactive access, and the victim’s own Microsoft Edge browser to carry Microsoft Graph API traffic.

The implant polls a SharePoint drive in an attacker-controlled Azure tenant every 15 seconds, receives commands, executes them and sends data back through the same channel. Ontinue said the design makes command-and-control activity difficult to separate from legitimate Microsoft cloud traffic because Graph API requests are issued from a headless Edge instance on the compromised device.

Credential capture and internal pivoting

Ontinue assesses that initial access occurred through a Microsoft Teams social-engineering attack. An operator posing as IT support persuaded a target to run a PowerShell command that downloaded an archive containing the Python runtime and a 39 MB compiled payload named bootstrap-fat.pyc, which acts as the TWINLOOT loader.

One channel is a SharePoint file dead drop, while the other provides a reverse SOCKS5 tunnel for interactive access and lateral movement. The tunnel can use a direct TLS or WebSocket connection, or WebRTC DataChannels relayed through Teams TURN infrastructure. The operator receives a SOCKS5 listener at 127.0.0.1:1080 and can proxy traffic from the compromised host to internal services, including SMB on port 445, RDP on 3389, WinRM on 5985 and MSSQL on 1433.

TWINLOOT also has a credential-harvesting feature. When sent the credz_waiting command, it displays a pixel-accurate fake Windows lock screen. The entered password is encrypted and uploaded to the SharePoint drive. The prompt always reports that the password is incorrect, which may encourage a victim to enter the real password on a second attempt, before the false screen closes.

Browser transport and persistence techniques

The framework launches Edge in headless mode, enables remote debugging and controls the browser through the Chrome DevTools Protocol. It then opens graph.microsoft[.]com and uses the Drive API to interact with the attacker’s SharePoint location. This browser-mediated model has parallels with Edge password exposure and active security issues, where Edge password exposure and other active security issues illustrated why browser activity deserves close monitoring in enterprise environments.

Ontinue described TWINLOOT as the first observed tool to combine Microsoft 365 dead-drop command-and-control, Teams TURN relay abuse and headless-browser transport in one framework. Its findings follow reporting on Backdoor.Turn, which used a QUIC session through Teams relay infrastructure, and msaRAT, which used WebRTC DataChannels through Twilio TURN relays. TWINLOOT uses WebRTC DataChannels through the aiortc library.

Persistence is optional by build and can include TypeLib COM scriptlet hijacking, GhostTask-style TaskCache manipulation, self-updating through a reobf.json manifest, and an NTUSER.MAN technique using Swarmer. Ontinue called the latter the first recorded malicious use of this method in the wild: the implant creates a mandatory profile hive offline, which Windows loads in preference to NTUSER.DAT when the file is present.

What security teams should examine

The operator behind TWINLOOT has not been identified. Ontinue noted operational overlaps with STAC4749, including Teams voice phishing, PyArmor-obfuscated Python tooling and reverse SOCKS5 capabilities, but said the implementation differs substantially. The framework also supports reconnaissance, discovery and screenshot capture, while an unused Ethereum-based configuration fallback suggests active development.

For businesses, the immediate implication is to validate Teams-based support requests, restrict or monitor PowerShell execution, and investigate unexpected headless-browser debugging and Graph API activity. Defenders should also review outbound connections from pythonw.exe to internal administration ports, because those connections can make attacker-led movement appear to originate from an ordinary compromised endpoint.