TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks
Ontinue disclosed TWINLOOT, a Python implant hiding C2 in SharePoint dead drops and Teams TURN relays, harvesting credentials and pivoting via reverse SOCKS5.
60
Malware
TWINLOOT
- Mentions · 7d0
- Mentions · 30d0
- All mentions1
- First seenAug 18, 2026
- Last mentionedAug 18, 2026
Timeline
1 articles · newest firstAppears with
- Microsoft Edgeproduct · 1
- Ontinueorganization · 1
- Microsoftvendor · 1
- SharePoint Onlineproduct · 1
- Microsoft Graph APIproduct · 1
- Microsoft Teamsproduct · 1
- Ontinuevendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.