TWINLOOT Malware Hides Inside Microsoft's Own Cloud to Steal Passwords
A newly discovered piece of malicious software uses Microsoft SharePoint, Teams, and Edge to run its operation, making it nearly invisible to the tools most companies rely on.
Key points
- Security firm Ontinue discovered TWINLOOT in July while investigating an active attack campaign.
- The malware runs its control channel through Microsoft SharePoint, Teams, and the Edge browser, so its traffic looks like normal Microsoft activity.
- On command, it fakes a Windows login screen to silently steal the victim's password.
- TWINLOOT is only the second piece of malware ever seen using Microsoft Teams' networking layer as a covert tunnel, and the first to use it the way it does here.
- Defenders are advised to watch for unusual SharePoint file activity, strange Graph API calls, and abnormal Python processes rather than relying on signature-based detection.
Most malware phones home to a server criminals own. TWINLOOT doesn't bother. Instead, it hides its entire operation inside Microsoft's own cloud services, making its traffic look identical to the everyday software millions of offices already use.
Researchers at Ontinue, a cyber defence firm, found the malware in July while investigating a live attack. They published their findings Tuesday, first shared with CSO Online ahead of release.
How does TWINLOOT actually work?
The malware uses three separate Microsoft channels to receive orders and send stolen data back to its operators, none of which point to any server the criminals own.
First, it checks a SharePoint Online folder, Microsoft's cloud file-sharing service, roughly every 15 seconds for new instructions. Results and stolen data get written back to the same folder. The malware logs into an attacker-controlled Microsoft account, not the victim's, so the victim's own Microsoft security logs show nothing unusual.
Second, for deeper access, TWINLOOT opens a covert tunnel through Microsoft Teams' networking infrastructure. A tunnel here means a hidden pathway through which the attackers can reach other computers on the victim's internal network, as if they were sitting at the victim's own desk.
Third, it launches the Microsoft Edge browser in a hidden mode called headless, where the browser runs invisibly in the background with no visible window, then uses it to send commands through the Microsoft Graph API, a standard Microsoft programming interface. To any monitoring tool, that traffic looks like Edge doing its job.
| Channel | What it does |
|---|---|
| SharePoint Online | Receives instructions; sends stolen data every 15 seconds |
| Microsoft Teams TURN network | Opens hidden tunnel into the victim's internal systems |
| Headless Microsoft Edge | Issues API commands that appear to be normal browser traffic |
| Fake Windows lock screen | Captures the victim's password silently |
How does it steal passwords?
TWINLOOT shows the victim a fake Windows login screen that looks completely real, filled in with the victim's actual account details. Whatever password the person types is quietly copied, encrypted, and sent to the SharePoint folder. The screen then shows a normal "incorrect password" message, the user tries again, and eventually logs in as normal. They never know anything happened.
The stolen password can then let attackers move through other machines on the same network.
The malware can also make itself permanent on a computer without needing administrator-level access, and does so in a way that leaves no standard security log entry. Ontinue says this specific persistence trick has never been seen used in the wild before.
"TWINLOOT works because defenders have been trained to treat Microsoft traffic as safe by default," said Shane Barney, chief information security officer at Keeper Security. "There is no attacker-owned domain in the chain, which means the traffic looks exactly like what it is supposed to look like."
Should ordinary employees be worried?
If you work for an organisation that uses Microsoft 365, SharePoint, or Teams, you will not be able to spot this attack yourself. The fake login screen is the one moment where awareness helps: if your screen locks and asks for your password at an unexpected moment, treat that as suspicious and call your IT team before typing anything.
For security teams, the practical advice from Ontinue is to monitor for unusual SharePoint and Teams activity, anomalous Microsoft Graph API calls, and unexpected Python processes running on employee machines. Disabling the headless mode of Microsoft Edge where it is not needed is also recommended, as is switching to phishing-resistant authentication methods, where logging in requires something more than a password alone.
