Ontinue’s Cyber Defense Center has uncovered a previously undocumented Python malware framework used in an ongoing campaign investigated in July 2026. The company tracks the implant as TWINLOOT, named after the “TwinLoot” SharePoint folder used for command and control (C&C).
TWINLOOT is a modular Python implant protected with PyArmor 9.2.5 Pro that keeps its C&C infrastructure inside trusted Microsoft services like SharePoint Online, Microsoft Graph API and Microsoft Teams TURN servers.
The initial compromise began with social engineering through Microsoft Teams. An attacker posing as IT support convinced a user to run a PowerShell command. The command downloaded an archive containing a Python 3.12.9 embeddable runtime and a 39 MB compiled payload.
The first-stage loader (bootstrap-fat.pyc) contained about 29 MB of embedded dependencies and malware modules. The second stage was protected by PyArmor and included roughly 120 modules. Ontinue was able to recover 115 modules and decrypt the embedded configuration.
TWINLOOT uses two C&C channels at the same time. The first is a SharePoint dead drop used for tasking and data theft. The implant authenticates to an attacker-controlled Azure tenant and polls a SharePoint drive for commands every 15 seconds. It can receive instructions, return command results, and exfiltrate credentials and reconnaissance data.
The second channel is a reverse SOCKS5 tunnel for interactive access. It can use a direct TLS/WebSocket connection to the attacker or a WebRTC DataChannel relayed through Microsoft Teams TURN servers. The attacker can operate a SOCKS5 listener on their own system and use it to reach internal services through the compromised host, including SMB on port 445, RDP on 3389, WinRM on 5985 and MSSQL on 1433.
“The reverse SOCKS5 tunnel is where the real operational damage happens. Once established (via either the direct TLS/WS tunnel or the Teams TURN channel), the operator has an interactive proxy that exits from the victim’s pythonw.exe process into the victim’s internal network,” the researchers said.
“What this means operationally: the operator harvests the victim’s password via the fake lock screen (exfiltrated through the SharePoint channel), then immediately uses those credentials through the SOCKS5 tunnel to RDP or WinRM into the next host. The compromised endpoint becomes a pivot point. To internal network defences, the lateral movement traffic looks like the compromised user’s workstation making normal administrative connections,” Ontinue further explains.
TWINLOOT also uses the victim’s own Edge browser in headless mode to send Microsoft Graph traffic. This makes the network activity look like normal Microsoft 365 traffic.
The implant implements several other capabilities, including arbitrary command execution, credential theft through pixel-perfect fake Windows lock screens, network reconnaissance and multiple persistence methods.
In one instance, researchers found an offline-forged mandatory profile hive created without administrative privileges. Ontinue calls the technique “Corrupting the Hive Mind” and described it as the first recorded malicious use of this persistence method in the wild.
“TWINLOOT is the first we have seen to combine Microsoft 365 dead-drop C2, Teams TURN relay abuse and headless browser transport within a single framework. It shows the gap between “conference research” and “operational tooling” has narrowed to weeks,” the report notes.