Security researchers have identified a sophisticated malware framework called TWINLOOT that turns Microsoft’s own cloud infrastructure into a command-and-control network. Rather than connecting to suspicious external servers — which security tools are trained to flag — TWINLOOT routes all its traffic through SharePoint and Microsoft Teams, making it nearly indistinguishable from normal business activity.
TWINLOOT arrives via Teams itself: threat actors pose as IT support and convince targets to run a PowerShell command that downloads the malware. Once installed, it uses SharePoint as a dead drop — polling for attacker commands every 15 seconds and uploading stolen data through the same channel. A second channel abuses Teams’ own relay servers for interactive access. The malware can display a convincing fake Windows lock screen to trick victims into typing their real password, then uses those credentials to move through the network via RDP, SMB, and other internal protocols. Researchers from Ontinue’s Cyber Defense Center, who discovered the framework during an active campaign in July 2026, linked it to a threat cluster associated with Chaos ransomware deployments.
How to check if you’re affected
Affected products include Microsoft Teams and SharePoint Online in any business or enterprise environment. IT and security teams should look for:
- Unusual
pythonw.exeprocesses establishing outbound connections to Microsoft Graph API endpoints - Teams messages from accounts claiming to be IT support and asking users to paste PowerShell commands into a terminal
- Unexpected SharePoint drive activity in audit logs, particularly frequent API polling from workstations
If your organization uses Microsoft Teams, treat any unsolicited request to run commands as a social engineering attempt — legitimate IT departments do not ask employees to execute PowerShell through chat.