A newly discovered Python implant demonstrates how threat actors are increasingly embedding malicious infrastructure within legitimate cloud and collaboration platforms. TWINLOOT uses SharePoint, Microsoft Graph, Teams TURN relays and Microsoft Edge to conceal command-and-control traffic inside trusted Microsoft environments. Of particular concern is a persistence technique that can operate without administrator privileges.

Ontinue’s Cyber Defense Center identified the previously unknown Python implant, now tracked as TWINLOOT, in July 2026. Its name derives from a SharePoint folder used within the malware’s command-and-control infrastructure. What distinguishes TWINLOOT is not a single exploit, but the systematic use of legitimate Microsoft services throughout the attack chain. Instead of relying solely on conspicuous attacker-controlled command-and-control servers, the malware makes extensive use of Microsoft 365 and Azure services. This creates a significant detection challenge. SharePoint, Microsoft Graph, Teams and Edge generate traffic that is entirely normal in many enterprise environments. Malicious communications can therefore blend into activity that security teams would usually regard as trusted or expected.

SharePoint and Teams become part of the C2 infrastructure

TWINLOOT uses two parallel communication channels once a system has been compromised. The first is a SharePoint-based dead drop used for tasking. The implant checks for new instructions approximately every 15 seconds. The second channel consists of a reverse SOCKS5 tunnel that provides interactive access and supports lateral movement within the victim environment. This connection can be established either directly or through WebRTC data channels using Microsoft Teams TURN servers as relays. Traffic to Microsoft Graph is routed through a headless Microsoft Edge instance running on the compromised endpoint. This architecture makes conventional detection based primarily on destination reputation increasingly difficult. Connections to established Microsoft services may appear legitimate even when they are supporting an active intrusion. TWINLOOT therefore illustrates a broader problem for enterprise security teams: trusted cloud infrastructure can itself become part of the attacker’s operational environment.

Initial access through voice phishing

According to Ontinue, the attack typically begins with voice phishing, or vishing. The attacker contacts a target through Microsoft Teams while posing as an internal IT support employee. The victim is then persuaded to execute a PowerShell script, providing the initial foothold required to deploy the implant. The use of a familiar enterprise collaboration platform adds credibility to the social-engineering element of the attack. Employees may be more inclined to trust a supposed IT administrator contacting them through a tool already used internally. Once deployed, TWINLOOT establishes its communication infrastructure and provides the attacker with several mechanisms for maintaining access and stealing credentials. One particularly notable feature is a highly convincing imitation of the Windows lock screen. The malware displays a pixel-accurate fake login interface and captures any password entered by the victim without actually validating it against Windows. The technique combines technical compromise with credential harvesting in a way that may be difficult for users to recognise.

Persistence without administrator privileges

Among the four persistence mechanisms identified by Ontinue, one is considered especially noteworthy. TWINLOOT can forge a mandatory-profile hive by manipulating the Windows profile file NTUSER.MAN. Windows prioritises this file when loading certain user profiles during login. By modifying the profile, an attacker can arrange for malicious code to execute automatically when the user signs in without relying on more conventional Registry-based autostart mechanisms. According to Ontinue, the technique does not require administrator privileges. The persistence mechanism can survive user logoffs, subsequent logins and system restarts. Because it avoids traditional autorun locations, it may also escape tools designed primarily to identify standard Windows persistence mechanisms. Ontinue describes TWINLOOT as the first known malicious use of this technique. This aspect of the campaign may ultimately prove more significant than the malware itself. Once a previously undocumented persistence method becomes public, other threat actors can potentially incorporate it into their own toolsets.

More than 100 protected modules decrypted

During its investigation, Ontinue identified around 120 modules protected with PyArmor. The Cyber Defense Center was able to statically decrypt 115 of them without executing the malware, providing extensive insight into the implant’s command structure, C2 endpoints and supporting infrastructure. The underlying infrastructure appears to have been prepared over a period of approximately seven weeks. Investigators identified hijacked or expired domains and a shared TLS certificate that, according to Ontinue, indicates infrastructure operated by a single threat actor or centrally coordinated group. Hosting was also linked to an autonomous system previously associated with credential-based attacks. There are technical similarities with STAC4749, a cluster associated with the Chaos ransomware ecosystem. However, the available evidence is not sufficient to support a definitive attribution.

Defenders need to look beyond trusted domains

TWINLOOT highlights the limits of security models that treat communication with well-known cloud providers as inherently trustworthy. Ontinue recommends monitoring connections to SharePoint tenants outside an organisation’s own environment and restricting external Microsoft Teams access where it is not operationally required. Security teams should also consider disabling Microsoft Edge headless mode and remote debugging capabilities through policy when there is no legitimate business requirement for them. Python runtimes operating from user-writable locations such as %APPDATA% and %TEMP% should receive additional scrutiny, particularly in environments where Python is not normally required by end users. If TWINLOOT’s fake Windows lock screen is suspected, affected passwords should be reset and active sessions and authentication tokens revoked. Organisations should also accelerate adoption of phishing-resistant authentication technologies such as FIDO2 security keys and passkeys. These measures can significantly reduce the value of credentials captured through social-engineering techniques.

Legitimate cloud services are becoming part of the attack surface

The wider lesson from TWINLOOT is that the distinction between trusted infrastructure and malicious infrastructure is becoming increasingly blurred. Threat actors no longer need to build every component of an attack platform themselves. Instead, they can exploit widely used SaaS, cloud and communications services to relay traffic, store instructions or disguise malicious activity as legitimate business communication. For security operations teams, detection therefore needs to move beyond simple indicators such as known malicious domains, suspicious IP addresses or unfamiliar applications. The more relevant questions increasingly concern behaviour and context: whether a Microsoft service is being accessed in a manner consistent with the user, endpoint and organisation — and whether activity that appears legitimate at the network level is actually supporting an intrusion. TWINLOOT shows how quickly trusted enterprise platforms can become dual-use infrastructure. As attackers continue to exploit the same cloud services used every day by legitimate organisations, behavioural analytics, identity telemetry and contextual detection will become even more important elements of enterprise defence.