AI Weekly Malaysia

Ontinue's Cyber Defense Center disclosed TWINLOOT, a PyArmor-hardened Python implant that runs its entire C2 infrastructure inside trusted Microsoft services: SharePoint Online dead drops via Graph API for tasking, Teams TURN servers for interactive WebRTC access, and the victim's own headless Edge browser to ferry traffic so it looks legitimate. Initial access was via a Teams social engineering attack where someone impersonated IT support and convinced a target to run a PowerShell command downloading a 39 MB payload ('bootstrap-fat.pyc').

Why: If your organization uses Microsoft 365 and Teams, this shows a concrete attack chain where those trusted services become the C2 channel itself—SharePoint polling every 15 seconds, Teams TURN relays for reverse shells, and Edge browser traffic that blends into normal usage. The practical takeaway is to tighten Teams external messaging policies and train staff against IT-support impersonation, since that PowerShell one-liner was the entire foothold.