--- title: New Malware turns Microsoft cloud into its control center description: A newly discovered Python malware framework, dubbed TWINLOOT, abuses SharePoint Online, Microsoft Teams' TURN infrastructure, and a headless instance of the... canonical: https://daily.dev/posts/new-malware-turns-microsoft-cloud-into-its-control-center-gwsh3laj6 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: New Malware turns Microsoft cloud into its control center | daily.dev og:description: A newly discovered Python malware framework, dubbed TWINLOOT, abuses SharePoint Online, Microsoft Teams' TURN infrastructure, and a headless instance of the... og:url: https://daily.dev/posts/new-malware-turns-microsoft-cloud-into-its-control-center-gwsh3laj6 og:image: https://api.daily.dev/og/posts/gWsH3lAJ6.png og:image:alt: New Malware turns Microsoft cloud into its control center og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # New Malware turns Microsoft cloud into its control center **[CSO Online](https://daily.dev/sources/csoonline)** · 4 min read · 0 upvotes · 0 comments ## Summary A newly discovered Python malware framework, dubbed TWINLOOT, abuses SharePoint Online, Microsoft Teams' TURN infrastructure, and a headless instance of the victim's own Edge browser to hide command-and-control traffic inside trusted Microsoft services. Discovered by Ontinue's Cyber Defense Center during a July investigation, the implant authenticates to an attacker-controlled Azure tenant so it produces no logs in the victim's Entra ID, uses a fake lock screen to harvest credentials without ever validating them, and persists via a novel offline NTUSER.MAN mandatory-profile hive technique requiring no admin rights. Defenders are advised to focus on behavioral and identity anomaly detection rather than signature-based malware detection, disable Edge headless mode, and monitor unusual Graph API and SharePoint/Teams activity. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does TWINLOOT malware hide its command-and-control traffic inside Microsoft services? TWINLOOT routes C2 traffic through SharePoint Online as a file-based dead drop polled roughly every 15 seconds, uses Microsoft Teams' TURN infrastructure with WebRTC DataChannels for a reverse SOCKS5 tunnel, and launches a headless Edge browser to issue Microsoft Graph API calls as same-origin fetch requests, making traffic look like legitimate Microsoft activity. _Security teams tracking cloud-abuse malware techniques like this can follow ongoing coverage on daily.dev._ ### Why doesn't TWINLOOT malware generate authentication logs in a victim's Entra ID? TWINLOOT authenticates to an attacker-controlled Azure tenant rather than the victim's own Microsoft 365 environment, so its login activity produces no authentication or audit events in the victim's Entra ID logs, letting the attacker operate without leaving a trace in identity monitoring tools. _Anyone hardening Entra ID logging against stealthy cloud abuse can track detection guidance like this on daily.dev._ ### What is the NTUSER.MAN persistence technique used by TWINLOOT malware? Called 'Corrupting the Hive Mind' by Ontinue researchers, this persistence technique creates a Windows NTUSER.MAN mandatory-profile hive offline, requiring no administrator privileges and generating no registry modification event, marking the first known in-the-wild use of this method. _Defenders researching novel Windows persistence tricks can keep up with findings like this via daily.dev._ ## Similar posts on daily.dev - [Ransomware gang abuses Microsoft Teams relays to hide malicious traffic](https://daily.dev/posts/ransomware-gang-abuses-microsoft-teams-relays-to-hide-malicious-traffic-w9qf9jps7) · BleepingComputer · 0 upvotes · 0 comments - [Crooks found a new way to collaborate using Teams – by hiding command-and-control traffic](https://daily.dev/posts/crooks-found-a-new-way-to-collaborate-using-teams-by-hiding-command-and-control-traffic-c4zhsotyu) · The Register · 0 upvotes · 0 comments - [KongTuke hackers now use Microsoft Teams for corporate breaches](https://daily.dev/posts/kongtuke-hackers-now-use-microsoft-teams-for-corporate-breaches-mfyblr8i6) · BleepingComputer · 0 upvotes · 0 comments - [Counterfeit installers turn routine software downloads into enterprise breaches](https://daily.dev/posts/counterfeit-installers-turn-routine-software-downloads-into-enterprise-breaches-mezthho2a) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#microsoft](https://daily.dev/tags/microsoft), [#azure](https://daily.dev/tags/azure), [#malware](https://daily.dev/tags/malware) [View this post on daily.dev](https://daily.dev/posts/new-malware-turns-microsoft-cloud-into-its-control-center-gwsh3laj6) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"New Malware turns Microsoft cloud into its control center","url":"https://daily.dev/posts/new-malware-turns-microsoft-cloud-into-its-control-center-gwsh3laj6","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/new-malware-turns-microsoft-cloud-into-its-control-center-gwsh3laj6"},"datePublished":"2026-08-18T11:12:43.623Z","dateModified":"2026-08-18T11:14:19.417Z","description":"A newly discovered Python malware framework, dubbed TWINLOOT, abuses SharePoint Online, Microsoft Teams' TURN infrastructure, and a headless instance of the...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa1f5870c8e293a7f710bb6d0db59115?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa1f5870c8e293a7f710bb6d0db59115?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"CSO Online","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"CSO Online","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/98667e4b5cac46cf9c470819c6cf71cd","url":"https://daily.dev/sources/csoonline"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/new-malware-turns-microsoft-cloud-into-its-control-center-gwsh3laj6","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,microsoft,azure,malware","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"CSO Online","item":"https://daily.dev/sources/csoonline"},{"@type":"ListItem","position":3,"name":"New Malware turns Microsoft cloud into its control center"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/new-malware-turns-microsoft-cloud-into-its-control-center-gwsh3laj6#faq","mainEntity":[{"@type":"Question","name":"How does TWINLOOT malware hide its command-and-control traffic inside Microsoft services?","acceptedAnswer":{"@type":"Answer","text":"TWINLOOT routes C2 traffic through SharePoint Online as a file-based dead drop polled roughly every 15 seconds, uses Microsoft Teams' TURN infrastructure with WebRTC DataChannels for a reverse SOCKS5 tunnel, and launches a headless Edge browser to issue Microsoft Graph API calls as same-origin fetch requests, making traffic look like legitimate Microsoft activity. Security teams tracking cloud-abuse malware techniques like this can follow ongoing coverage on daily.dev."}},{"@type":"Question","name":"Why doesn't TWINLOOT malware generate authentication logs in a victim's Entra ID?","acceptedAnswer":{"@type":"Answer","text":"TWINLOOT authenticates to an attacker-controlled Azure tenant rather than the victim's own Microsoft 365 environment, so its login activity produces no authentication or audit events in the victim's Entra ID logs, letting the attacker operate without leaving a trace in identity monitoring tools. Anyone hardening Entra ID logging against stealthy cloud abuse can track detection guidance like this on daily.dev."}},{"@type":"Question","name":"What is the NTUSER.MAN persistence technique used by TWINLOOT malware?","acceptedAnswer":{"@type":"Answer","text":"Called 'Corrupting the Hive Mind' by Ontinue researchers, this persistence technique creates a Windows NTUSER.MAN mandatory-profile hive offline, requiring no administrator privileges and generating no registry modification event, marking the first known in-the-wild use of this method. Defenders researching novel Windows persistence tricks can keep up with findings like this via daily.dev."}}]} ```