TWINLOOT Abuses Microsoft Services to Steal Credentials and Move Across Networks

Cybersecurity researchers have identified a previously undocumented Python implant framework called TWINLOOT. The framework, which is designed to operate within Microsoft services, can steal credentials and move across networks.

TWINLOOT uses multiple command-and-control (C2) channels, including SharePoint Online for tasking and Teams TURN relays for interactive access. It also utilizes a headless instance of the victim's own Edge browser to make traffic indistinguishable from legitimate network activity.

The researchers discovered TWINLOOT during an investigation into an ongoing campaign in July 2026. The framework harvests Windows credentials using pixel-perfect fake lock screens and offers a reverse SOCKS5 pivot into victim networks, allowing it to execute arbitrary commands and establish persistence on the host.