TWINLOOT Hijacks SharePoint & Teams to Steal Credentials

Introduction

In the evolving landscape of cyber threats, attackers are increasingly turning to legitimate cloud platforms for stealth and persistence. A new Python‑based implant, dubbed TWINLOOT, has emerged that exploits trusted Microsoft services such as SharePoint and Teams to exfiltrate credentials and move laterally across corporate networks.

Security researchers have dissected TWINLOOT’s architecture, revealing a modular design hardened with PyArmor and a command‑and‑control chain that runs entirely inside Microsoft’s tenant. The result is a tool that can hide from traditional defenses while harvesting sensitive login data and expanding its foothold inside victim environments.

Unveiling the TWINLOOT Framework

TWINLOOT is not a single monolithic payload. Instead, it is a collection of interchangeable modules written in Python and protected by PyArmor, a tool that obfuscates code to thwart static analysis. The framework’s core functions include:

• Credential Harvesting:TWINGLOOT pulls stored credentials from local Windows credential stores, Office 365 vaults, and even browser‑saved passwords.
• Lateral Movement:Once inside, the implant can pivot into adjacent systems using SMB, PowerShell remoting, and RDP, all orchestrated through the same cloud‑based command channel.
• Persistence:It registers itself as a scheduled task and places a service binary in the system registry, ensuring it survives reboots.
• Data Exfiltration:Collected data is compressed, encrypted, and sent back to the attacker via SharePoint document uploads and Teams chat messages.

Why Microsoft Services? The Inside Attack

Leveraging Microsoft’s own services offers twoprit powerful advantages:

• Legitimacy and Trust:Security tools and monitoring systems often allow traffic to and from Office 365 and Teams, reducing the likelihood of detection.
• End‑to‑End Encryption:Data travels over HTTPS, making it difficult for network sensors to inspect payloads without breaking the encryption.
• High Availability:Microsoft’s cloud is globally distributed; if one node is taken down, the implant can immediately switch to another, maintaining persistence.

The command‑and‑control (C2) logic is ingeniously embedded in SharePoint files. When the implant needs a new instruction, it queries a dedicated SharePoint folder using the Microsoft Graph API, downloading a JSON payload that dictates the next action. Teams chat messages serve as an additional covert channel, allowing the attacker to push updates or request additional credentials without raising suspicion.

Inside the Code: How TWINLOOT Operates

At runtime, the implant follows a four‑phase cycle:

1. Initialization:It checks for the presence of a specific SharePoint site and Teams channel. If absent, it creates them using the Graph API.
2. Credential Acquisition:System APIs and PowerShell scripts are executed to pull credentials from the Windows Credential Manager, Office 365 vault, and browsers like Edge and Chrome.
3. Lateral Expansion:Using the harvested credentials, the implant authenticates against neighboring systems. It then deploys a lightweight PowerShell backdoor to those machines, repeating the cycle.
4. Data Transfer:Captured data is zipped, encrypted with a hardcoded key, and uploaded to the SharePoint folder. Simultaneously, a Teams message is sent to a pre‑configured channel했다 announcing the success and providing a link to the bulk file.

Real‑World CCR Impact: What Companies Are Facing?

While the full extent of TWINLOOT’s spread is still being assessed, early indicators suggest that organizations with extensive Microsoft 365 adoption—especially those who rely heavily on SharePoint for collaboration—are prime targets. Potential consequences include:

• Compromise of privileged accounts, leading to data breaches or ransomware deployment.
• Regulatory fines for failing to protect personal data if the implant steals PII.
• Operational disruption due to lateral movement across critical infrastructure.

Defense Strategies: Protecting Your Cloud Environment

Murcia can mitigate TWINLOOT risks through a layeredATFORM approach:

• Zero Trust for Microsoft 365:Enable Conditional Access, enforce MFA, and restrict app permissions so the implant cannot create new SharePoint sites or Teams channels.
• Enhanced Monitoring:Deploy Microsoft Defender for Cloud Apps to flag anomalous file uploads and unusual API calls to Graph.
• Endpoint Hardening:Use application whitelisting, restrict local PowerShell execution, and keep all systems patched.
• Credential Guard:Protect Windows credential stores from being read by unauthorized processes.
• Incident Response Playbooks:Include procedures for isolating compromised machines that have executed the TWINLOOT backdoor.

Conclusion

TWINLOOT demonstrates that attackers are no longer confined to traditional malware distribution. By embedding a fully functional command‑and‑control system inside trusted Microsoft services, they can operate undetected and harvest credentials at scale քեզ. Organizations must treat their cloud environments with the same rigor as on‑premises networks, employing zero‑trust principles, robust monitoring, and continuous threat hunting. With tools like Grivyonx Cloud’s AI‑driven automation and cyber intelligence, security teams can stay one step ahead, turning the very cloud they rely on into a cornerstone of resilience rather than a vector for compromise.