{"id":10515,"date":"2026-08-18T18:32:54","date_gmt":"2026-08-18T22:32:54","guid":{"rendered":"https:\/\/hostingdiscussion.com\/news\/?p=10515"},"modified":"2026-08-18T18:32:54","modified_gmt":"2026-08-18T22:32:54","slug":"malware-turns-trusted-cloud-services-into-a-hackers-hiding-place","status":"publish","type":"post","link":"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/","title":{"rendered":"Malware turns trusted cloud services into a hacker&#8217;s hiding place"},"content":{"rendered":"<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">A newly discovered piece of malware doesn&#8217;t need its own servers anymore. It just borrows yours, or rather, Microsoft&#8217;s cloud.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Researchers at <a href=\"https:\/\/www.ontinue.com\/resource\/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure\/#h-persistence-one-technique-you-should-know-about\" target=\"_blank\" rel=\"noopener noreferrer nofollow\">Ontinue&#8217;s Cyber Defense Center<\/a> uncovered the framework, which they now call TWINLOOT, while investigating an active attack in July. What makes it different from typical malware is where it lives. Instead of phoning home to some suspicious server, TWINLOOT routes its entire command and control operation through cloud services security teams are trained to trust: <a href=\"https:\/\/hostingdiscussion.com\/news\/sharepoint-servers-under-siege-as-zero-day-exploit-bypasses-mfa-protections\/\">SharePoint Online<\/a>, Microsoft Teams, and a hijacked instance of the victim&#8217;s own Edge browser talking to the Microsoft Graph API. To most cloud monitoring tools, none of it looks out of place.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">That&#8217;s the real shift researchers are flagging. In theory, cloud platforms make security easier to reason about. Instead, attackers are learning to operate entirely inside that trust, using the cloud&#8217;s own reliability against the people defending it.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">One technique in particular shows how far this goes. On command, the malware throws up a fake Windows lock screen using the victim&#8217;s real account details. It never checks whether the password is correct. Instead, it captures, encrypts, and quietly pushes every attempt out through the SharePoint channel, while the victim just sees a normal &#8220;wrong password&#8221; message and tries again.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">&#8220;TWINLOOT works because defenders have been trained to treat Microsoft traffic as safe by default, and this malware was built to take full advantage of that,&#8221; said Shane Barney, chief information security officer at Keeper Security. He noted there&#8217;s no attacker owned domain anywhere in the chain, which is exactly why cloud-facing detection tools tend to leave it alone.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Ontinue says this is the first confirmed case of the malware abusing real WebRTC data channels inside Teams&#8217; TURN infrastructure, the same cloud relay system that keeps video calls connected, to tunnel deeper into a victim&#8217;s network. It also uses a persistence trick that needs no admin rights and leaves nothing behind in the registry.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\">Robert Coles, senior manager of threat intelligence at Black Duck, said the bigger story is a pattern across cloud environments generally. <a href=\"https:\/\/hostingdiscussion.com\/news\/cybersecurity-transformed-over-five-years-as-home-networks-and-ai-shape-risk-landscape\/\">Attackers<\/a> are increasingly building their operations inside platforms organizations already rely on, rather than standing up infrastructure of their own. He recommends leaning on behavioral and identity monitoring across cloud accounts rather than chasing malware signatures.<\/p>\n<p class=\"font-claude-response-body break-words whitespace-normal\" dir=\"ltr\"><a href=\"https:\/\/hostingdiscussion.com\/news\/microsoft-cloud-outage-disrupts-email-files-teams-for-enterprises\/\">Microsoft<\/a> had not responded to a request for comment as of this report. Researchers are urging cloud administrators to disable Edge&#8217;s headless mode, audit Graph API and OAuth activity, and move toward phishing resistant authentication across their cloud tenants.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>A newly discovered piece of malware doesn&#8217;t need its own servers anymore. It just borrows yours, or rather, Microsoft&#8217;s cloud. Researchers at Ontinue&#8217;s Cyber Defense Center uncovered the framework, which they now call TWINLOOT, while investigating an active attack in July. What makes it different from typical malware is where it lives. Instead of phoning [&hellip;]<\/p>\n","protected":false},"author":20624,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[71],"tags":[7781,7778,5328,3470,7780,7779],"class_list":["post-10515","post","type-post","status-publish","format-standard","hentry","category-featured","tag-cloud-identity-monitoring","tag-cloud-malware","tag-cloud-security-threats","tag-microsoft-cloud","tag-sharepoint-teams","tag-twinloot-cloud-attack"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.2 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Malware turns trusted cloud services into a hacker&#039;s hiding place - Web Hosting News<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Malware turns trusted cloud services into a hacker&#039;s hiding place - Web Hosting News\" \/>\n<meta property=\"og:description\" content=\"A newly discovered piece of malware doesn&#8217;t need its own servers anymore. It just borrows yours, or rather, Microsoft&#8217;s cloud. Researchers at Ontinue&#8217;s Cyber Defense Center uncovered the framework, which they now call TWINLOOT, while investigating an active attack in July. What makes it different from typical malware is where it lives. Instead of phoning [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/\" \/>\n<meta property=\"og:site_name\" content=\"Web Hosting News\" \/>\n<meta property=\"article:published_time\" content=\"2026-08-18T22:32:54+00:00\" \/>\n<meta name=\"author\" content=\"Justine Juyad\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Justine Juyad\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/\",\"name\":\"Malware turns trusted cloud services into a hacker's hiding place - Web Hosting News\",\"isPartOf\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\"},\"datePublished\":\"2026-08-18T22:32:54+00:00\",\"dateModified\":\"2026-08-18T22:32:54+00:00\",\"author\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\"},\"breadcrumb\":{\"@id\":\"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/hostingdiscussion.com\/news\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Malware turns trusted cloud services into a hacker&#8217;s hiding place\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#website\",\"url\":\"https:\/\/hostingdiscussion.com\/news\/\",\"name\":\"Web Hosting News\",\"description\":\"Cloud and web hosting industry daily news\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3\",\"name\":\"Justine Juyad\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g\",\"caption\":\"Justine Juyad\"},\"description\":\"HostingDiscussion.com senior reporter\",\"sameAs\":[\"https:\/\/hostingdiscussion.com\/news\/\"],\"url\":\"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Malware turns trusted cloud services into a hacker's hiding place - Web Hosting News","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/","og_locale":"en_US","og_type":"article","og_title":"Malware turns trusted cloud services into a hacker's hiding place - Web Hosting News","og_description":"A newly discovered piece of malware doesn&#8217;t need its own servers anymore. It just borrows yours, or rather, Microsoft&#8217;s cloud. Researchers at Ontinue&#8217;s Cyber Defense Center uncovered the framework, which they now call TWINLOOT, while investigating an active attack in July. What makes it different from typical malware is where it lives. Instead of phoning [&hellip;]","og_url":"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/","og_site_name":"Web Hosting News","article_published_time":"2026-08-18T22:32:54+00:00","author":"Justine Juyad","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Justine Juyad","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/","url":"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/","name":"Malware turns trusted cloud services into a hacker's hiding place - Web Hosting News","isPartOf":{"@id":"https:\/\/hostingdiscussion.com\/news\/#website"},"datePublished":"2026-08-18T22:32:54+00:00","dateModified":"2026-08-18T22:32:54+00:00","author":{"@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3"},"breadcrumb":{"@id":"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/hostingdiscussion.com\/news\/malware-turns-trusted-cloud-services-into-a-hackers-hiding-place\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/hostingdiscussion.com\/news\/"},{"@type":"ListItem","position":2,"name":"Malware turns trusted cloud services into a hacker&#8217;s hiding place"}]},{"@type":"WebSite","@id":"https:\/\/hostingdiscussion.com\/news\/#website","url":"https:\/\/hostingdiscussion.com\/news\/","name":"Web Hosting News","description":"Cloud and web hosting industry daily news","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/hostingdiscussion.com\/news\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/3a1732732b90f8c57c2a0ec68d3c49e3","name":"Justine Juyad","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/hostingdiscussion.com\/news\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/96df33d01870f85226adf8492251fbefe00bc349b10bb7679b094f3fa086999c?s=96&d=mm&r=g","caption":"Justine Juyad"},"description":"HostingDiscussion.com senior reporter","sameAs":["https:\/\/hostingdiscussion.com\/news\/"],"url":"https:\/\/hostingdiscussion.com\/news\/author\/justine-juyad\/"}]}},"views":81,"_links":{"self":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10515","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/users\/20624"}],"replies":[{"embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/comments?post=10515"}],"version-history":[{"count":1,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10515\/revisions"}],"predecessor-version":[{"id":10516,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/posts\/10515\/revisions\/10516"}],"wp:attachment":[{"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/media?parent=10515"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/categories?post=10515"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostingdiscussion.com\/news\/wp-json\/wp\/v2\/tags?post=10515"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}