TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Summary

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file

Lotu Radar provides attributed news summaries and links to the original publisher. Full reporting and copyright remain with the source.