TWINLOOT turns SharePoint and Teams into its C2, hides in your own Edge browser
A new PyArmor-hardened Python implant, TWINLOOT, runs its entire C2 inside Microsoft 365: SharePoint dead-drops for tasking, Teams TURN relays for interactive access, all ferried through the victim's headless Edge browser. Delivered via a fake IT-support Teams call, it steals credentials, pivots over SOCKS5, and looks like normal cloud traffic.