{
  "id": 1695306,
  "title": "New malware turns Microsoft 365 and Azure into its control center",
  "url": "https://urgent.news/2026/08/18/new-malware-turns-microsoft-365-and-azure-into-its-control-center",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-18T11:12:47.000Z",
  "source": {
    "name": "Computerworld",
    "slug": "computerworld",
    "url": "https://www.computerworld.com/article/4210979/new-malware-turns-microsoft-365-and-azure-into-its-control-center.html"
  },
  "original_language": "en",
  "account": "Security analysts have issued a warning about a recently discovered Python-based malware framework called TWINLOOT. Discovered while investigating an active campaign in July, TWINLOOT leverages Microsoft services like SharePoint Online, Microsoft Teams, and headless instances of the Edge browser to carry out its command-and-control (C2) activities. The malware takes advantage of defenders' tendency to treat Microsoft traffic as safe, thereby evading detection.\n\nTWINLOOT operates by separating routine tasking from \"interactive\" access. Its SharePoint channel periodically polls a drive for commands, returning results and exfiltrating stolen credentials and reconnaissance data. When interactive access is required, the malware can establish a reverse SOCKS5 tunnel using Microsoft's Teams TURN infrastructure, allowing the operator to access the internal network.\n\nTWINLOOT is notable for abusing Microsoft Teams' TURN infrastructure, a technique used only twice in the wild. It also launches Microsoft Edge in headless mode, uses the Chrome DevTools Protocol, and issues Graph API calls through legitimate browser communication. This technique, which issues \"same-origin fetch ()\" requests, is difficult to detect as it appears to be a regular Edge process communicating with Microsoft.\n\nThe malware displays a Windows 10 or Windows 11 lock screen with the victim's real account information, never validating the password. Instead, every password attempt is captured, encrypted, and sent to the SharePoint C2 channel. The stolen credentials can enable lateral movement through the reverse SOCKS tunnel, potentially granting RDP, SMB, or WinRM access to other systems. TWINLOOT also features a unique persistence technique called \"Corrupting the Hive Mind,\" which creates a Windows \"NTUSER.MAN\" mandatory-profile hive offline, requiring no administrator privileges and leaving no registry modification event.",
  "summary": "Security researchers are warning of a newly uncovered Python malware framework that routes much of its command-and-control (C2) activity through Microsoft services that defenders already expect to see. The Ontinue Cyber Defense Center discovered the implant while investigating an active campaign in July and has since tracked it as TWINLOOT. It was seen using SharePoint Online as a file-based dead…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}