Silent 'TwinLoot' Cyber Threat Operates Entirely From Microsoft's Cloud

Researchers discovered a sophisticated Python malware framework named TwinLoot that uses Microsoft 365 and Azure services (SharePoint, Graph API, Teams TURN relay, and the victim's Edge browser) as a stealthy command-and-control and interactive access plane. TwinLoot modules enable credential harvesting via pixel-faithful fake Windows lock screens, a reverse SOCKS5 pivot for internal network access, and a novel persistence method—an offline-forged mandatory profile hive—making detection by traditional indicators difficult and prompting recommendations for behavioral and UEBA-based defenses.