Abstract

TWINLOOT is a newly disclosed Python implant that operates within trusted Microsoft 365 infrastructure, using SharePoint, Teams TURN relays, and a headless Edge browser to camouflage command-and-control traffic as legitimate enterprise activity. The malware facilitates credential harvesting via fake lockscreen prompts and enables lateral movement through an integrated SOCKS5 proxy, following an initial access vector of Teams-based social engineering.