As reported by The Hacker News, Ontinue's Cyber Defense Center has uncovered TWINLOOT, a Python-based implant that runs its entire command-and-control infrastructure inside Microsoft 365 services. This is not just another remote access trojan — it is a proof-of-concept for a detection problem that most enterprise security stacks are not built to solve.

Threat Alert: This is not just another remote access trojan — it is a proof-of-concept for a detection problem that most enterprise security stacks are not built to solve.

The Core Problem: Traffic That Is Legitimate by Design

TWINLOOT's most significant innovation is not any single feature but its wholesale adoption of living off trusted infrastructure. By routing C2 tasking through SharePoint Online via the Microsoft Graph API and relaying interactive sessions through Teams TURN servers, the implant generates traffic that firewall rules, proxy logs, and CASB policies are configured to allow, not inspect. The use of the victim's own headless Edge browser to ferry Graph API traffic compounds this — the network connections originate from a signed Microsoft binary, authenticated to the organization's own tenant, hitting Microsoft-owned IP ranges.

The question defenders must now ask is not "did we block this connection?" but "are we capable of distinguishing a legitimate SharePoint polling pattern from one that repeats every 15 seconds from a pythonw.exe-spawned browser instance?"
For most organizations, the answer is no. Egress allowlists for Microsoft 365 endpoints are considered best practice. Threat hunting against Graph API usage patterns is rare. And Teams TURN traffic is encrypted WebRTC — opaque to most network inspection tools by design.

Initial Access: Teams Social Engineering Is the Soft Underbelly

The reported initial access vector — an attacker impersonating IT support via Microsoft Teams and convincing a user to execute a PowerShell one-liner — should sound familiar. External Teams messaging has been abused for phishing throughout 2025 and 2026, and Microsoft's default settings for external tenant communication remain more permissive than most security teams realize. The fact that TWINLOOT's delivery chain depends on a human saying "yes" to a Teams chat and pasting a command into a terminal means that identity verification and external communication policies are now first-line malware controls, not just productivity guardrails.

Capabilities and Risk Surface

Initial Access: Teams Social Engineering Is the Soft Underbelly
Credential harvesting via fake lock screens: Pixel-perfect credential capture bypasses traditional keylogger detections that look for known API hooking patterns.
Reverse SOCKS5 pivoting through Teams TURN: Enables lateral movement to internal services (SMB, RDP, WinRM) from the operator's machine — effectively turning the victim host into a relay without requiring VPN or RDP exposure.
PyArmor obfuscation: The 39 MB compiled payload complicates static analysis and sandbox detonation, delaying reverse engineering and signature development.
Persistence mechanisms: Long-term footholds that survive reboots and user session changes.

Who Is Most Exposed

Organizations with heavy Microsoft 365 reliance, permissive external Teams communication policies, and endpoint detection that relies primarily on process lineage and known-bad indicators are the primary targets. Mid-market enterprises without dedicated threat hunting capacity are especially vulnerable — they are unlikely to detect anomalous Graph API polling patterns or investigate WebRTC relay usage from non-standard processes.

Shield53 Recommendations

Immediate Actions

  • Restrict external Teams access: Review and tighten Teams external communication policies in the Teams admin center. Limit external federated chat to verified domains only. Disable external messaging for users who do not require it for business functions.
  • Deploy Graph API activity monitoring: Enable audit logging for SharePoint Online and Microsoft Graph access. Create alerting rules for anomalous authentication patterns from non-standard OAuth applications or service principals.
  • Hunt for TWINLOOT indicators: Search for pythonw.exe spawning msedge.exe with headless arguments, repeated Graph API polling at ~15-second intervals, and outbound WebRTC connections from non-browser processes to Teams TURN infrastructure.
  • Enforce application allowlisting: Block execution of pythonw.exe and unsigned Python runtimes from user-writable directories unless explicitly approved. This disrupts the bootstrap-fat.pyc delivery chain.
  • Implement conditional access for Graph API: Require compliant device and managed identity for Graph API access where possible. Monitor for authentication from unexpected Azure tenants.

Strategic Hardening

  • Invest in behavioral analytics for M365: UEBA tooling that baselines normal SharePoint and Teams usage per user can flag the repetitive polling and unusual relay patterns TWINLOOT depends on.
  • Conduct Teams-based social engineering exercises: Include external Teams impersonation in phishing simulation programs. Users are conditioned to distrust email links but often treat Teams messages as inherently trusted.
  • Network segmentation for SMB/internal access: TWINLOOT's SOCKS5 pivot targets internal ports like 445. Microsegmentation limits the blast radius once a host is compromised.

TWINLOOT is a preview of where offensive tradecraft is heading. The infrastructure defenders trust most — identity providers, collaboration platforms, cloud APIs — is becoming the preferred medium for covert operations. The defenders who adapt first will be the ones who stop treating Microsoft 365 as inherently safe and start treating it as a contested environment that requires active monitoring, not passive trust.