Imagine your security team's worst nightmare: an attacker quietly issues commands, steals credentials, and moves laterally across your entire network — and every single packet of that malicious traffic looks exactly like your employees' normal Microsoft 365 activity. No suspicious domains. No flagged IP addresses. No unusual certificates. Just routine-looking cloud traffic hiding something deeply sinister underneath.

This is no longer a theoretical scenario.

A Python-based malware framework is taking the concept of living off the land (LOTL) to a whole new level by operating its entire command-and-control (C2) infrastructure from inside Microsoft Azure and Microsoft 365 services.

The implications for enterprise security teams are profound — and demand an urgent rethink of how we defend cloud environments.

Meet TWINLOOT: The Malware That Lives Inside Your Microsoft Stack

The Ontinue Cyber Defense Center uncovered an undocumented Python implant framework while investigating an ongoing campaign in July 2026, tracked as TWINLOOT — a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services.

What makes TWINLOOT so alarming is its architectural elegance.

TWINLOOT routes tasking through SharePoint Online via the Microsoft Graph API, relays interactive operator sessions through Microsoft Teams TURN servers using WebRTC DataChannels, and drives all of this traffic through a headless instance of the victim's own Edge browser.

The result is C2 activity that is functionally indistinguishable from legitimate Microsoft 365 usage at the network layer — a design choice that directly undermines detection strategies built around domain reputation, TLS fingerprinting, or anomalous destination analysis.

As Shane Barney, chief information security officer at Keeper Security, put it: "TWINLOOT works because defenders have been trained to treat Microsoft traffic as safe by default, and this malware was built to take full advantage of that."

How the Attack Unfolds: From Teams Chat to Full Network Access

Understanding the attack chain is the first step toward defending against it.

The initial access vector is assessed to be a social engineering attack via Microsoft Teams, in which the threat actor masquerading as IT support persuaded a target to run a PowerShell command responsible for downloading an archive file containing the Python runtime and a compiled payload that serves as a loader for TWINLOOT.

Once deployed, the malware establishes two parallel C2 channels.

The malware employs two distinct C2 channels to maintain covert communication. The first is a persistent "tasking channel" that leverages a SharePoint dead-drop mechanism, polling for instructions every 15 seconds. Attackers host a custom Azure tenant and SharePoint drive, with all outbound traffic from compromised systems directed to Microsoft domains such as login.microsoftonline.com and graph.microsoft.com.

Credential theft is built directly into the framework.

The malware includes a module for stealing credentials by displaying a counterfeit Windows lock screen. Upon receiving a "credz_waiting" command, TWINLOOT generates a visually accurate fake lock screen using Tkinter, replicating the victim's real display name, account image, and wallpaper.

Every password attempt is captured, encrypted, and sent to the SharePoint C2 channel. The victim receives a normal-looking incorrect password message before eventually authenticating the login. The stolen credentials can enable lateral movement through the reverse SOCKS tunnel, potentially allowing RDP, SMB, or WinRM access to other systems.

The Broader Trend: Cloud Abuse Is Accelerating

TWINLOOT is not an isolated case — it represents the sharp end of a rapidly maturing attack category.

Threat actors are identifying and developing new methods to exploit legitimate cloud services for activities such as malware hosting, C2 hosting, and data exfiltration.

There has been a rising number of reports involving cybercriminals leveraging the Microsoft Graph API to communicate with and host their command-and-control infrastructure on Microsoft cloud services.

By leveraging the Microsoft Graph API, cybercriminals are able to conduct malicious activities within the infrastructure of legitimate applications and services, successfully blending their activities with legitimate traffic.

Nation-state actors were early adopters of this approach.

More state-sponsored threat operations have been leveraging Microsoft Graph API alongside cloud services like Microsoft Outlook and OneDrive to facilitate data exfiltration in new cyberespionage campaigns.

The VEILDrive campaign brought this threat to critical infrastructure:

VEILDrive leverages Microsoft's SaaS suite — particularly Teams, SharePoint, Quick Assist, and OneDrive — to execute its tactics, with the threat actor utilising a OneDrive-based Command & Control method embedded within custom malware deployed on compromised environments.

Meanwhile, HOLLOWGRAPH took a different approach, with

HOLLOWGRAPH abusing the Microsoft Graph API to transform a compromised Microsoft 365 calendar into a covert two-way command-and-control channel, with commands and stolen data hidden inside calendar events with attachments dated to the year 2050, and communications protected using separate RSA key pairs for each communication direction.

Why Traditional Defenses Are Failing

The reason these attacks succeed so reliably comes down to a fundamental design assumption baked into most enterprise security stacks.

By using Graph API for command-and-control, reconnaissance, persistence, and even exfiltration, attackers blend malicious traffic into legitimate cloud workflows. Because Graph API usage is expected and noisy in cloud-first organisations, defenders are often flying blind.

Even sophisticated endpoint tools are being bypassed.

The VEILDrive malware evaded detection by a top-tier Endpoint Detection and Response (EDR) tool and all security engines in VirusTotal. This highlights a critical risk: even non-obfuscated, straightforward code can evade modern detection mechanisms, suggesting a broader need to revisit detection strategies in high-risk environments.

Persistence mechanisms are also growing more creative.

TWINLOOT uses a novel technique called "Corrupting the Hive Mind," which creates a mandatory Windows profile hive by leveraging RegLoadAppKeyW and offreg.dll, triggering a mandatory profile override when Windows loads a user profile. Crucially, this requires no administrative privileges and generates no registry modification events.

As Jason Soroko, a senior fellow at Sectigo, explained: "This approach undermines security measures relying on domain reputation, IP blocking, or assumptions about Microsoft 365 traffic being benign."

Storm-2949 and the Identity-First Attack Model

The TWINLOOT framework is not the only major cloud-native threat enterprise teams need to contend with.

Microsoft Threat Intelligence disclosed a cyberattack carried out by a threat actor tracked as Storm-2949, which escalated from a targeted identity compromise into a large-scale breach of cloud infrastructure and sensitive enterprise systems — demonstrating how compromised identities can become gateways to an organization's entire cloud ecosystem.

Rather than deploying traditional malware or relying on conventional on-premises attack methods, the attackers abused legitimate cloud administration tools and Azure management features to blend into normal activity while gaining access to high-value systems.

Microsoft said the attackers targeted Azure App Services, Key Vaults, Storage accounts, SQL databases, and virtual machines.

The identity angle is particularly important.

These attacks do not rely on traditional methods like stolen passwords but instead exploit legitimate platform features by gaining user consent through deceptive applications. Once access is granted, attackers can operate with elevated privileges, often without triggering standard security alerts.

Practical Tips: How to Defend Your Enterprise Right Now

The good news is that while these attacks are sophisticated, they are not undetectable. Security teams that shift their thinking from perimeter-based detection to cloud-native behavioral analysis will have a fighting chance. Here's where to start:

When malicious traffic blends seamlessly with normal user activity, traditional detection methods fail. Security teams must establish baselines for SharePoint, Teams, and Graph API interactions and monitor for deviations.

Enforce phishing-resistant MFA and conditional access policies on Microsoft 365 and Azure AD accounts, and restrict SharePoint and Graph API app permissions to reduce dead-drop viability.

Disable or tightly govern browser remote debugging interfaces such as the Edge or Chrome DevTools Protocol via group policy, since TWINLOOT and comparable tools depend on CDP access to drive the victim's browser as a C2 transport.

The Microsoft Graph Activity Log combined with Kusto Query Language (KQL) offers the foundational visibility needed to uncover these threats. Security teams should investigate risky OAuth apps using Microsoft Defender for Cloud Apps to gain insights into app permissions and community trust levels.

Ensure that any connections are to your own tenants — accounts that belong to your enterprise — and lock down everything else.

This prevents malware from authenticating outbound to attacker-controlled Azure tenants as TWINLOOT does.

The presence of python.exe initiating outbound connections to administrative ports (445, 3389, 5985, 22, 1433, 135, 389) on multiple internal IPs represents anomalous behaviour

— a reliable detection signal even when C2 channels are otherwise invisible.

Look for the deviceCode grant type in Entra ID sign-in logs, particularly where the application ID is unfamiliar, the device platform doesn't match the user's typical environment, or authentication originates from an unusual location. Legitimate device code usage in most enterprise environments is narrow and predictable.

Conclusion: The Perimeter Is Now Inside Your Cloud

The era of defending Microsoft 365 and Azure environments by simply trusting Microsoft's own IP space is over.

While it is common for attackers to use cloud infrastructure to hide activity, frameworks like TWINLOOT have some unique qualities that demonstrate new sophistication — and which will require new defensive thinking.

The attack surface has fundamentally shifted inward, into the trusted services your workforce depends on every single day.

TWINLOOT is the first tool to combine Microsoft 365 dead-drop C2, Teams TURN relay abuse, and headless browser transport under a single umbrella

— but it almost certainly will not be the last. The gap between cutting-edge conference research and operational attacker tooling has, as researchers noted, narrowed to a matter of weeks.

Is your security team equipped to detect threats that look exactly like legitimate Microsoft traffic? Now is the time to audit your cloud security posture, implement behavioral baselines across your Microsoft 365 environment, and invest in cloud-native detection capabilities before the next TWINLOOT-class threat finds its way into your SharePoint folders. Don't wait for an incident response engagement to reveal the gaps — start today.