FlagThis — Daily Cybersecurity Intelligence Briefing

TWINLOOT is a Python-based enterprise-native implant that weaponizes Microsoft 365 services for command-and-control. Attackers use external Microsoft Teams tenant messaging to impersonate IT support and deliver a PowerShell execution chain. The implant leverages SharePoint dead-drops for C2 and exfiltration, abuses Teams TURN relays, and controls headless Microsoft Edge via Chrome DevTools Protocol to blend traffic with legitimate browser activity. It harvests credentials via fake Windows lock-screen prompts and enables lateral movement through an integrated SOCKS5 proxy. Observed across at least three independent threat actors, this TTP cluster bypasses perimeter controls by routing malicious traffic through trusted M365 infrastructure.