TwinLoot Runs Its Entire C2 From Azure and 365, No Malicious Infrastructure Needed
Researchers have found a Python malware framework, TwinLoot, that pushes living-off-the-land to new extremes: all of its command-and-control runs from inside Microsoft Azure and 365 services, so nothing on the attacker's side is ever exposed. A modular implant steals credentials and persists with far less to catch.