Silent 'TwinLoot' Cyber Threat Operates Entirely From Microsoft's Cloud
New 'TwinLoot' malware uses Microsoft cloud for stealthy credential theft and persistence.
A new malware framework named 'TwinLoot' has been discovered, leveraging Microsoft's cloud infrastructure to operate with extreme stealth. This Python-based malware employs living-off-the-land tactics, using a modular implant to steal credentials and establish persistence on compromised systems, making it difficult to detect.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe TwinLoot malware framework exploits trusted Microsoft cloud infrastructure to blend malicious activity with legitimate traffic, making traditional signature-based detection largely ineffective. By employing living-off-the-land (LotL) techniques, attackers avoid deploying suspicious binaries, instead weaponizing native tools and trusted cloud services already present in the environment. This modular, Python-based implant can steal credentials and establish persistence while generating minimal noise in security logs. The threat highlights a growing trend of adversaries abusing legitimate cloud platforms to bypass perimeter defenses and erode trust-based detection models. Organizations that rely solely on blacklist-based or perimeter security controls are particularly exposed to this class of attack.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.