New Malware turns Microsoft cloud into its control center
This title could be clearer and more informative.Try out Clickbait Shieldfor free (5 uses left this month).
A newly discovered Python malware framework, dubbed TWINLOOT, abuses SharePoint Online, Microsoft Teams' TURN infrastructure, and a headless instance of the victim's own Edge browser to hide command-and-control traffic inside trusted Microsoft services. Discovered by Ontinue's Cyber Defense Center during a July investigation, the implant authenticates to an attacker-controlled Azure tenant so it produces no logs in the victim's Entra ID, uses a fake lock screen to harvest credentials without ever validating them, and persists via a novel offline NTUSER.MAN mandatory-profile hive technique requiring no admin rights. Defenders are advised to focus on behavioral and identity anomaly detection rather than signature-based malware detection, disable Edge headless mode, and monitor unusual Graph API and SharePoint/Teams activity.
Questions this post answers
How does TWINLOOT malware hide its command-and-control traffic inside Microsoft services?
TWINLOOT routes C2 traffic through SharePoint Online as a file-based dead drop polled roughly every 15 seconds, uses Microsoft Teams' TURN infrastructure with WebRTC DataChannels for a reverse SOCKS5 tunnel, and launches a headless Edge browser to issue Microsoft Graph API calls as same-origin fetch requests, making traffic look like legitimate Microsoft activity. Security teams tracking cloud-abuse malware techniques like this can follow ongoing coverage on daily.dev.
Why doesn't TWINLOOT malware generate authentication logs in a victim's Entra ID?
TWINLOOT authenticates to an attacker-controlled Azure tenant rather than the victim's own Microsoft 365 environment, so its login activity produces no authentication or audit events in the victim's Entra ID logs, letting the attacker operate without leaving a trace in identity monitoring tools. Anyone hardening Entra ID logging against stealthy cloud abuse can track detection guidance like this on daily.dev.
What is the NTUSER.MAN persistence technique used by TWINLOOT malware?
Called 'Corrupting the Hive Mind' by Ontinue researchers, this persistence technique creates a Windows NTUSER.MAN mandatory-profile hive offline, requiring no administrator privileges and generating no registry modification event, marking the first known in-the-wild use of this method. Defenders researching novel Windows persistence tricks can keep up with findings like this via daily.dev.