Researchers uncovered an active malware campaign ("TWINLOOT") that hides its command-and-control traffic inside trusted Microsoft services like SharePoint, Teams, and Microsoft Graph. It can trick users by showing a realistic Windows lock screen and capturing every password attempt, then sending those captured credentials out through SharePoint.
TWINLOOT is malware observed in an active campaign in July that abuses trusted Microsoft services to hide its activity. Rather than relying on obviously malicious infrastructure, it uses SharePoint Online as a command channel and data drop, polling frequently and exfiltrating stolen credentials and reconnaissance data through it. It can also route interactive operator access through Microsoft Teams TURN/WebRTC, which makes internal network access appear to originate from the victim's own machine.
The credential theft component works by displaying a Windows 10 or Windows 11 lock screen populated with the victim's real account information. The screen never validates the password entered. Instead, every attempt is captured, encrypted, and sent to the SharePoint command and control channel. The victim sees a normal-looking incorrect password message before eventually being let through, which masks the theft as an ordinary login hiccup.
The campaign's effectiveness comes from abusing trust in a widely used platform. Because TWINLOOT authenticates to an attacker-controlled Azure tenant rather than the victim's own tenant, it reduces visibility in the victim's Entra ID logs. Traffic to SharePoint, Teams, and Microsoft Graph looks like normal enterprise activity, so defenders who have been trained to treat Microsoft traffic as inherently safe may overlook anomalies that would otherwise stand out.
Organizations can reduce risk from this kind of attack by combining user awareness with detection tuning. Employees across all roles, including IT support, IAM, SOC staff, and privileged users, should be taught to treat unexpected login or lock screens as suspicious and to report repeated password failures immediately, particularly when they did not lock or reboot their device. Security teams should focus on anomalous SharePoint, Teams, and Graph activity patterns rather than signature-based detection alone, and should be prepared to reset exposed credentials quickly and move toward phishing-resistant authentication when a suspicious prompt is reported.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
TWINLOOT is malware observed in an active campaign that abuses Microsoft 365 and Azure components like SharePoint, Teams, and Microsoft Graph to blend command-and-control traffic into normal enterprise activity.
It displays a realistic Windows 10 or Windows 11 lock screen populated with the victim's real account information, then captures every password attempt without ever validating it, sending the data to a SharePoint command channel.
It authenticates to an attacker-controlled Azure tenant rather than the victim's own tenant, which reduces visibility in the victim's Entra ID logs, and it uses trusted Microsoft services to appear as normal traffic.
Treat unexpected login or lock screen prompts, and repeated incorrect password messages, as suspicious and report them immediately, especially if they did not lock or reboot the device themselves.
Imagine you’re working, and suddenly your PC shows a Windows 10 or 11 lock screen with your name and email on it. With TWINLOOT malware, that lock screen can be fake. It never checks your password; every attempt you type is grabbed, encrypted, and quietly sent out through SharePoint like normal Microsoft 365 traffic. Here’s the tell: you didn’t lock or reboot, but you’re suddenly asked to sign in again, and your password keeps getting rejected with normal-looking error messages, then eventually works. That pattern is a TWINLOOT-style red flag. If your screen locks out of nowhere or your correct password fails twice, stop typing and call the security team immediately so they can reset your credentials and check for TWINLOOT activity.
Researchers observed an active campaign where attackers used Microsoft Teams to impersonate IT support and trick a user into running a PowerShell command. That action downloaded a malicious package that enabled credential theft (via a fake lock screen) and helped attackers move through internal…
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Researchers found a new macOS infostealer, “ClickLock Stealer,” that uses ClickFix-style fake verification pages to trick people into running Terminal commands. After infection, it shows a realistic macOS password prompt and can effectively lock the Mac until the victim enters the correct password,…
Microsoft reports MacSync Stealer infections that start when a user is tricked into pasting or running commands in macOS Terminal (a “ClickFix” style lure). Those commands use built-in tools like curl to download and run the payload, then the stealer collects credentials and sensitive files, stages…
The bulletin describes an APT36 (Transparent Tribe) espionage campaign that uses social-engineering lures and spoofed download portals to trick targets into installing a malicious Windows installer. The installer (“TMS_AfghanTelecom.exe”) deploys the PATCHCORD backdoor, which then calls out to…
Researchers showed how an attacker could trick Microsoft Copilot into running a malicious prompt automatically just by getting a user to click a specially crafted link. The prompt can then make Copilot search connected accounts (like email and cloud storage) and send information to an external…
