TWINLOOT Abuses Share Point and Teams to Steal Credentials and Move Across Networks
Summary: Ontinue disclosed TWINLOOT, a PyArmor-hardened Python implant that runs its command-and-control inside Microsoft services: tasking through SharePoint Online file dead-drops via the Microsoft Graph API, and operator access through WebRTC DataChannels relayed by Microsoft Teams TURN servers, with Graph API traffic driven by a headless instance of the victim's own Edge browser. Initial access is assessed as a Teams social engineering attack in which an actor posing as IT support persuaded a target to run a PowerShell command that downloaded a 39 MB compiled payload, bootstrap-fat.pyc, and the implant harvests credentials with pixel-perfect fake lock screens, opens a reverse SOCKS5 pivot, and persists via a mandatory NTUSER.MAN profile hive built with RegLoadAppKeyW and offreg.dll.
What's compelling: The SharePoint channel polls for commands every 15 seconds and the SOCKS5 tunnel exits from pythonw.exe to internal hosts on ports 445, 3389, 5985 and 1433, so to the victim's own network the compromised host looks like it is making normal lateral connections. Ontinue notes this is the first recorded malicious use of the NTUSER.MAN persistence method in the wild, and that two unrelated actors arrived independently at driving the victim's own browser as a C2 transport within the same month.
Read the original at The Hacker News ↗
- Topics
- Phishing & Social Engineering
- Related
- US disrupts North Korean campaign behind $400 million crypto theft Cyber Risks · Nov 14, 2026North Korea ‘s Crypto Theft Operations: DOJ Seizes $1.2 Billion and Disrupts Hacker Infrastructure Cyber Risks · Nov 13, 2026FBI Says North Korean Hackers Stole Over $400 Million in Crypto Using Deepfake Video Calls Cyber Risks · Nov 13, 2026