A newly discovered piece of malware doesn’t need its own servers anymore. It just borrows yours, or rather, Microsoft’s cloud.
Researchers at Ontinue’s Cyber Defense Center uncovered the framework, which they now call TWINLOOT, while investigating an active attack in July. What makes it different from typical malware is where it lives. Instead of phoning home to some suspicious server, TWINLOOT routes its entire command and control operation through cloud services security teams are trained to trust: SharePoint Online, Microsoft Teams, and a hijacked instance of the victim’s own Edge browser talking to the Microsoft Graph API. To most cloud monitoring tools, none of it looks out of place.
That’s the real shift researchers are flagging. In theory, cloud platforms make security easier to reason about. Instead, attackers are learning to operate entirely inside that trust, using the cloud’s own reliability against the people defending it.
One technique in particular shows how far this goes. On command, the malware throws up a fake Windows lock screen using the victim’s real account details. It never checks whether the password is correct. Instead, it captures, encrypts, and quietly pushes every attempt out through the SharePoint channel, while the victim just sees a normal “wrong password” message and tries again.
“TWINLOOT works because defenders have been trained to treat Microsoft traffic as safe by default, and this malware was built to take full advantage of that,” said Shane Barney, chief information security officer at Keeper Security. He noted there’s no attacker owned domain anywhere in the chain, which is exactly why cloud-facing detection tools tend to leave it alone.
Ontinue says this is the first confirmed case of the malware abusing real WebRTC data channels inside Teams’ TURN infrastructure, the same cloud relay system that keeps video calls connected, to tunnel deeper into a victim’s network. It also uses a persistence trick that needs no admin rights and leaves nothing behind in the registry.
Robert Coles, senior manager of threat intelligence at Black Duck, said the bigger story is a pattern across cloud environments generally. Attackers are increasingly building their operations inside platforms organizations already rely on, rather than standing up infrastructure of their own. He recommends leaning on behavioral and identity monitoring across cloud accounts rather than chasing malware signatures.
Microsoft had not responded to a request for comment as of this report. Researchers are urging cloud administrators to disable Edge’s headless mode, audit Graph API and OAuth activity, and move toward phishing resistant authentication across their cloud tenants.
