Python Malware Uses SharePoint and Teams to Hide Command Traffic

Cybersecurity researchers have uncovered a previously unknown Python-based malware framework called TWINLOOT that routes its entire command-and-control infrastructure through trusted Microsoft services to evade detection. Ontinue disclosed the framework in a technical report shared in August 2026, after discovering the implant during an investigation into an active campaign in July. The malware operates by sending commands through SharePoint Online file dead-drops via Microsoft Graph API while routing interactive operator access through WebRTC DataChannels relayed by Microsoft Teams TURN servers, making network traffic virtually indistinguishable from legitimate activity.

The implant runs two parallel communication channels from infected machines: a SharePoint dead drop that authenticates to an attacker's Azure tenant and polls a SharePoint drive for commands every 15 seconds, and a reverse SOCKS5 tunnel for interactive access and lateral movement that runs over either direct TLS/WebSocket connections or through Teams TURN WebRTC relay. Traffic to and from the Graph API is powered by a headless instance of the victim's own Edge browser, which the malware launches in headless mode and controls via Chrome DevTools Protocol. The initial infection vector is a social engineering attack through Microsoft Teams in which the threat actor impersonates IT support and convinces targets to run a PowerShell command that downloads an archive containing the Python runtime and a 39 MB compiled payload. The implant can harvest Windows credentials using pixel-perfect fake lock screens, execute arbitrary commands, and establish persistence through four methods including TypeLib COM scriptlet hijack, GhostTask-style TaskCache manipulation, and a technique using the open-source tool Swarmer to create stealthy Registry keys in HKEY_CURRENT_USER without triggering security software.

According to Ontinue, the Python framework represents the first tool to combine Microsoft 365 dead drop command-and-control, Teams TURN relay abuse, and headless browser transport under a single umbrella. The cybersecurity firm described the threat actor as "knowledgeable in offensive tradecraft and Microsoft's cloud architecture." When the operator issues a credential harvesting command, the malware renders a bogus lock screen that doesn't validate entered passwords against Windows authentication—instead displaying an error message "The password is incorrect. Try again" regardless of input, likely prompting victims to enter the correct password on the second attempt. Every captured password is encrypted and uploaded to the SharePoint drive, then abused through the SOCKS5 tunnel to pivot to the next host using Remote Desktop Protocol or WinRM.

The emergence of TWINLOOT illustrates how multiple threat actors have independently adopted the same TURN relay abuse technique within a year of the method, codenamed Ghost Calls, being publicly disclosed by Praetorian. In June 2026, Symantec and Carbon Black detailed DragonForce ransomware's use of a Go-based remote access trojan called Backdoor.Turn that conceals command-and-control traffic inside Microsoft Teams relay infrastructure, while late last month another Rust-based RAT dubbed msaRAT was observed using the same TURN method against Twilio instead of Teams. Ontinue noted that Chaos group's msaRAT uses the same headless-browser-via-CDP architecture but for WebRTC signaling through Cloudflare Workers, calling the convergence notable: "two unrelated actors independently arrived at 'drive the victim's own browser as a C2 transport' within the same month." The development also marks the first recorded malicious use of the Swarmer persistence method in the wild, which creates mandatory Windows profile hives offline using RegLoadAppKeyW and Microsoft's offline registry library offreg.dll to write NTUSER.MAN files that take precedence over NTUSER.DAT when Windows loads user profiles. Ontinue said the toolkit shares operational parallels with a cluster called STAC4749, which has orchestrated Teams voice phishing campaigns to deploy Chaos ransomware, though the underlying implementation differs substantially—if the operators are the same, the tooling was rebuilt from scratch rather than evolved. Organizations face a fundamental challenge: the malware weaponizes the same trusted services that enable everyday productivity, forcing security teams to distinguish malicious automation from legitimate browser-driven workflows without disrupting business operations.