> TritonInfoSec News
Home / Aug 19, 2026 / Story
0
#8 The Hacker News general August 18, 2026 at 12:38 UTC

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

By [email protected] (The Hacker News)

AI Summary

Researchers at Ontinue disclosed TWINLOOT, a previously undocumented Python implant framework hardened with PyArmor that conducts its entire C2 operation through trusted Microsoft services — routing tasking through SharePoint Online files and communicating via Microsoft Teams — to evade network-based detection. The modular implant steals credentials and achieves lateral movement while blending into legitimate Microsoft 365 traffic. Security teams relying on network anomaly detection must augment controls with behavioral analysis of SharePoint and Teams API activity.

Read full article → https://thehackernews.com/2026/08/twinloot-abuses-…

Relevance score: 80.0/100

# More from August 19

  1. 1
    Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps The Hacker News
  2. 2
    Clop created custom web shell for Windchill data theft attacks BleepingComputer
  3. 3
    Philips and GE investigating Clop ransomware data theft claims BleepingComputer
  4. 4
    More than 200 victims of Medusa ransomware identified over the last year, CISA says The Record
  5. 5
    Critical GitLab Zero-Click Flaw Poses Mitigation Challenges Dark Reading
  6. 6
    Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access The Hacker News
  7. 7
    SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch The Hacker News
  8. 9
    CISA Flags Actively Exploited Ray Flaw That Can Trigger Browser-Based RCE The Hacker News
  9. 10
    Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware The Hacker News