TwinLoot Malware — Analysis, Campaigns & Threat Activity

Threat entity extracted from intelligence sources

Frequency

2

occurrences

First Seen

August 18, 2026

Last Seen

August 18, 2026

Related Threat Clusters

TwinLoot Malware Exploits Microsoft Cloud for Command-and-Control Operations
A new Python-based malware framework named TwinLoot has been discovered, utilizing Microsoft Azure and 365 services for command-and-control (C2) operations. Researchers from Ontinue Cyber Defense Center identified the…

2 articles · Updated August 18, 2026

Recent Intelligence Reports

Silent 'TwinLoot' Cyber Threat Operates Entirely From Microsoft's Cloud — Darkreading · August 18, 2026
New Malware turns Microsoft cloud into its control center — Csoonline · August 18, 2026

Related Entities

Malware Phishing Azure Microsoft Azure T1003 - OS Credential Dumping T1021 - Remote Services T1041 - Exfiltration Over C2 Channel T1056 - Input Capture T1059 - Command and Scripting Interpreter T1071 - Application Layer Protocol T1090 - Proxy Entra ID