LOWVulnerability
Global

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

·Source: The Hacker News

Updated:

Executive Summary

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file

Analysis

Cybersecurity researchers have disclosed details of a previously undocumented Python implant framework dubbed TWINLOOT. "TWINLOOT is a modular, PyArmor-hardened Python implant designed to operate its entire command-and-control infrastructure inside trusted Microsoft services," Ontinue said in a technical report shared with The Hacker News. "Tasking flows through SharePoint Online file
Source Attribution

Originally published by The Hacker News on Aug 18, 2026.

Related Threats

MEDIUMVulnerabilityNEW

Berlin cuts two state ministries off government network after security breach

The affected ministries — one responsible for urban development, construction and housing, and the other for mobility, transport, climate protection and the environment — have been isolated from government networks since Friday as a precaution.

The Record
MEDIUMVulnerabilityNEW

University of Texas forced to take systems offline in San Antonio after cyberattack

The University of Texas at San Antonio, which serves 40,000 students across six campuses, said its IT team identified threat activity on its academic campus over the weekend and took some systems, including phones, offline in response.

The Record
CRITICALVulnerabilityNEW

NVD CRITICAL: CVE-2026-75913 — CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an...

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool. The model-supplied rev parameter is passed unvalidated into the git show argv without an --end-of-options sentinel, so a value beginning with --output= is interpreted as a git flag. Because the tool is registered as auto-approved and advertised as read-only, an at

CVE-2026-75913
NIST NVD