TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file

Report facts: Researchers describe TWINLOOT as a modular, PyArmor-hardened Python implant framework that runs its command-and-control workflows entirely inside trusted Microsoft cloud services like SharePoint Online and Teams, abusing these collaboration platforms to move laterally and steal credentials. RealGround analysis: While the article focuses on general cyber intrusion rather than AI specifically, it highlights how attackers can hide malicious automation inside SaaS collaboration ecosystems that often underpin AI-enabled workflows and data pipelines. Organizations should treat SaaS platforms used by AI agents and models as part of their AI attack surface, enforcing strong identity controls, telemetry, and continuous red teaming to detect covert implant-style automation living inside “trusted” services. This kind of abuse also underscores the need for supply-chain visibility into third-party SaaS integrations that interact with AI systems and sensitive data.