TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
- ID
- 15179
- Status
- summarized
- Published
- 18 Aug 2026, 8:38 PM
- Fetched
- 18 Aug 2026, 9:42 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/twinloot-abuses-sharepoint-and-teams-to.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 5.5
- Created
- 18 Aug 2026, 9:45 PM
- Tags
- Audience
- developerssaas_founders
What happened
Ontinue's Cyber Defense Center disclosed TWINLOOT, a PyArmor-hardened Python implant that runs its entire C2 infrastructure inside trusted Microsoft services: SharePoint Online dead drops via Graph API for tasking, Teams TURN servers for interactive WebRTC access, and the victim's own headless Edge browser to ferry traffic so it looks legitimate. Initial access was via a Teams social engineering attack where someone impersonated IT support and convinced a target to run a PowerShell command downloading a 39 MB payload ('bootstrap-fat.pyc').
Why it matters
If your organization uses Microsoft 365 and Teams, this shows a concrete attack chain where those trusted services become the C2 channel itself—SharePoint polling every 15 seconds, Teams TURN relays for reverse shells, and Edge browser traffic that blends into normal usage. The practical takeaway is to tighten Teams external messaging policies and train staff against IT-support impersonation, since that PowerShell one-liner was the entire foothold.
Discussion angle
How trusted SaaS platforms (SharePoint, Teams, Graph API) can be turned into stealthy C2 channels—and whether your own org's Teams external-access settings would have blocked the initial social engineering message that kicked this off.