TwinLoot Malware: A New Era of Cloud-Based Cyber Threats
In August 2026, researchers uncovered 'TwinLoot,' a sophisticated Python-based malware framework that exploits Microsoft Azure and 365 services for its command-and-control operations. By leveraging SharePoint Online, Microsoft Graph API, and Teams' TURN relay infrastructure, TwinLoot disguises its malicious activities as legitimate cloud traffic. The malware's capabilities include credential harvesting through fake Windows lock screens, establishing reverse SOCKS5 proxies for network infiltration, executing arbitrary commands, and achieving persistence via a novel method termed 'Corrupting the Hive Mind,' which creates offline-forged mandatory profile hives without administrative privileges. This incident underscores the evolving threat landscape where attackers increasingly abuse trusted cloud services to evade detection. Organizations must enhance their monitoring of cloud-based activities and adopt behavioral analytics to identify anomalies indicative of such sophisticated attacks.
Kill Chain
