A newly identified Python malware framework uses Microsoft services to conceal its command-and-control (C2) activity, according to researchers at Ontinue. Dubbed TWINLOOT, the malware routes traffic through SharePoint and Teams infrastructure and uses a headless Microsoft Edge process to help disguise some communications.
Ontinue discovered TWINLOOT while responding to a July 2026 intrusion that began with a voice phishing, or vishing, call placed through Microsoft Teams. An attacker posing as IT support persuaded the victim to run a PowerShell command, which downloaded an archive bundling a Python runtime with a 39 MB compiled payload.
About 120 of the payload’s modules were protected with PyArmor, a tool that makes Python code harder to analyze. Ontinue recovered 115 of them and decrypted an embedded configuration file, revealing TWINLOOT’s C2 infrastructure, command set, and persistence methods.
Turning Microsoft 365 into the C2 infrastructure
TWINLOOT divides its C2 traffic between two main channels. The first is an attacker-controlled SharePoint site that acts as an always-on drop box for commands and stolen data. The implant polls the site every 15 seconds, retrieves new instructions, and uploads results through the Microsoft Graph API. It authenticates to the attacker’s Azure tenant, so the victim organization’s Microsoft 365 tenant is not part of that authentication flow.
For live, hands-on access, TWINLOOT can establish a reverse SOCKS5 tunnel through Microsoft Teams TURN servers using WebRTC DataChannels. That tunnel lets the operator route connections through the compromised computer and reach other systems on the internal network. Rather than embedding TURN credentials in the malware, TWINLOOT requests temporary credentials from Teams endpoints intended for anonymous visitors.
Ontinue researchers said TWINLOOT is the second malware they know of to abuse Teams TURN infrastructure in the wild and the first observed doing so with actual WebRTC DataChannels.
The implant adds another layer of concealment by launching Edge in headless mode and controlling it through the Chrome DevTools Protocol. Graph API requests are then made from inside the browser, so network monitoring sees msedge.exe communicating with Microsoft rather than a Python process.
“Attackers are no longer hiding traffic inside legitimate services,” said Jason Soroko, senior fellow at Sectigo. “They are assembling those services into the malware infrastructure itself.”
Stolen credentials could help attackers move deeper into the network
TWINLOOT can steal passwords by displaying a fake Windows lock screen built with details taken from the victim’s computer. It uses the person’s account name, profile picture, and lock-screen background to make the prompt look familiar. The screen does not check whether a password is correct. Instead, it encrypts each entry and uploads it through the SharePoint C2 channel.
The implant’s reverse SOCKS5 tunnel gives the attacker an interactive proxy into the organization’s network. Ontinue’s working theory is that the operator can take passwords captured by the fake lock screen and use them through that tunnel to connect to other systems over RDP, SMB, or WinRM.
The behavior also gives defenders a potential detection opportunity. A pythonw.exe process connecting to multiple internal systems over administrative ports could be a useful signal, particularly on workstations where that activity is unexpected.
A persistence technique that can evade registry monitoring
TWINLOOT includes four persistence methods, each activated by the operator rather than installed automatically. One stands out for using a technique based on recently published security research.
The method draws on security research published in January 2026 under the name “Corrupting the Hive Mind.” TWINLOOT uses the Windows function RegLoadAppKeyW and Microsoft’s offreg.dll library to construct an NTUSER.MAN mandatory-profile hive offline.
Because TWINLOOT constructs the hive outside the live registry, Ontinue said the technique produces no registry-modification events at write time and requires no administrator privileges.
Windows checks for NTUSER.MAN before loading the user’s normal NTUSER.DAT hive. If the mandatory-profile file is present, its settings can take precedence. The hive survives profile reloads and logon/logoff cycles.
Ontinue said it is the first malicious use of the technique that its researchers have observed in the wild. Defenders watching only for live registry changes or administrator-level activity could miss it. Monitoring profile-hive files and the endpoint activity surrounding their creation could provide additional visibility.
Researchers see similar C2 techniques in other malware
TWINLOOT is not the first malware observed abusing legitimate communications infrastructure to relay attacker traffic. DragonForce’s Backdoor.Turn also abused Microsoft Teams TURN servers, though it used a different implementation. The Chaos group’s msaRAT separately paired a headless browser with TURN infrastructure, routing its traffic through Twilio instead of Teams.
Ontinue also found parallels with activity tracked by Sophos as STAC4749. Both operations used Teams calls from fake IT personnel, PyArmor-protected Python malware and reverse SOCKS tooling. But the underlying implementations differ, and Ontinue found no evidence directly linking TWINLOOT to that actor.
The operation appears to have been planned over roughly seven weeks. The attacker re-registered expired domains, created an Azure application, and set up a SharePoint site before deploying the implant. The preparation indicates the operation was planned in advance rather than assembled immediately before the intrusion.
Ontinue said the cases point to separate threat actors independently adopting similar C2 techniques.
What defenders should watch for now
Ontinue recommends that defenders monitor managed endpoints connecting to SharePoint tenants outside the organization and investigate unusual activity involving SharePoint, Teams or Microsoft Graph. Organizations should also determine which users need external Teams access and restrict it where appropriate.
On endpoints, defenders should watch for unexpected use of Edge in headless mode, remote debugging or the Chrome DevTools Protocol. Those capabilities can be disabled on workstations that do not need them. Python or pythonw.exe running from user-writable directories should also draw attention, particularly when the process connects to multiple internal systems over administrative ports.
If a user may have entered a password into TWINLOOT’s fake lock screen, Ontinue recommends treating the credential as compromised, resetting it, and revoking the user’s active sessions.
No single signal tells the whole story. Defenders need to correlate endpoint, identity, network and cloud telemetry to identify activity that may appear legitimate in isolation.
“As threat actors increasingly abuse legitimate cloud services,” said Robert Coles, senior manager of threat intelligence security at Black Duck, “spotting what's unusual becomes more important than simply blocking what's known to be bad.”
