Microsoft’s own cloud services are becoming the command channel for a new Windows implant. Researchers at Ontinue documented TWINLOOT, a Python-based tool that abuses SharePoint and Teams to steal credentials and move laterally. It marks only the second in-the-wild case of Teams TURN abuse and the first using WebRTC DataChannels.
The malware authenticates to an attacker-controlled Azure tenant instead of the victim’s Microsoft 365 environment, so the victim’s Entra ID logs record nothing. For interactive access it runs a reverse SOCKS5 tunnel through Teams TURN infrastructure, letting operators reach SMB, RDP, and WinRM from the compromised box.
A headless Microsoft Edge session, driven through the Chrome DevTools Protocol, issues Graph API calls as same-origin fetch requests. Network telemetry shows what looks like a legitimate Edge process talking to Microsoft. The Drive API then reaches the attacker’s SharePoint, where a dead-drop stores configuration and stolen data.
Credential theft comes via a fake Windows 10 or 11 lock screen showing the victim’s real account information. The password is never validated; every attempt is encrypted and shipped to the SharePoint C2 channel while the victim sees a standard incorrect-password message.
For persistence, Ontinue describes a technique it calls “Corrupting the Hive Mind.” The implant builds an NTUSER.MAN mandatory-profile hive offline, needing no administrator privileges and generating no registry modification event. It is the first recorded malicious use of the method.
Ontinue draws parallels with STAC4749, a cluster linked to Teams voice phishing and Chaos ransomware deployment, but stresses the underlying implementation is substantially different. Defenders should monitor anomalous SharePoint, Teams, and Graph activity, disable Edge headless mode, and reset exposed credentials.
