--- title: When Your Own Microsoft 365 Becomes the Attacker's Channel - Capstone Technologies Group description: TWINLOOT malware hides its command traffic inside Microsoft 365, leaving no trace in your sign-in logs. What it means for professional-services firms. canonical_url: https://captechgroup.com/resources/blog/when-your-microsoft-365-becomes-the-attackers-channel language: en-GB date: 2026-08-30T12:28:33Z notice: This is a machine-friendly version of the page at https://captechgroup.com/resources/blog/when-your-microsoft-365-becomes-the-attackers-channel. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 1825 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/resources/blog/when-your-microsoft-365-becomes-the-attackers-channel. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. A malware family that researchers call TWINLOOT breaks an assumption most businesses rely on to keep their networks safe. Instead of sending stolen data and its instructions to servers the attacker owns — the kind of unfamiliar destination a firewall or web filter is built to flag — it routes that traffic through Microsoft's own cloud services. SharePoint, Teams, and the Microsoft Graph API: the same platforms your staff uses every day, and the same platforms your security tools are required to trust. The Ontinue Cyber Defense Center found the framework in July, and analysis published by CSO Online describes how it works. For a firm running Microsoft 365, the design has one uncomfortable consequence: the controls most businesses count on to catch an intrusion cannot see this one. ## Why the usual defenses miss it Blocklists, domain-reputation feeds, and web filtering all work on the premise that malicious traffic goes somewhere suspicious. TWINLOOT sends it to Microsoft instead — polling a SharePoint drive for commands, tunneling remote access over Teams call infrastructure, and making Graph API calls that read, on your network logs, as a normal Microsoft Edge process talking to Microsoft. There is no attacker-owned domain anywhere in the chain for a blocklist to catch. The second gap is the one with real cost attached. The malware authenticates to an attacker-controlled Microsoft tenant rather than yours, so no sign-in event, no consent grant, and no audit record appears in your Entra ID logs. When an investigation opens, the identity trail your responders normally start from is simply not there. They work from endpoint and network evidence alone, which typically lengthens the engagement and raises the hours billed by outside forensics. ## What it puts within reach Once the operator has a foothold, connections to internal file shares, remote-desktop interfaces, and management consoles appear to come from a workstation your controls already consider healthy. For a professional-services firm, the assets one authenticated hop away tend to be the sensitive ones: file shares holding client documents, contracts, and financial records; administrative interfaces; and the backup systems you would rely on to recover. That combination creates a compliance problem beyond the intrusion itself. Under most breach-notification rules, you can only scope what your records let you reconstruct. If the sign-in trail an investigator would normally use to determine which accounts and which data were reached is absent, demonstrating the scope of an incident — to a regulator, a cyber-insurance carrier, or a client — becomes materially harder. That evidentiary gap can matter as much as the technical breach. ## The practical takeaway The lesson of TWINLOOT is that “we block bad websites” is not a defense against a technique that never visits a bad website. Detecting this class depends on watching behavior rather than destinations: a workstation reaching internal systems it has no business reaching, an Edge process making Graph API calls no user initiated, authentication patterns that do not match how a real person works. In environments Capstone manages, identity threat detection watches for exactly those deviations — the authentication behavior that a stolen credential or a rogue tenant produces, which a domain blocklist was never built to see. None of this requires panic, and no single tool makes a network immune. What it should prompt is a specific question: if an intrusion left no trace in your Microsoft 365 sign-in logs, what evidence would you have? For most firms that answer is worth knowing before it is tested. The full technical breakdown — the SharePoint dead-drop, the Teams tunnel, and the fake lock screen that harvests passwords without generating a help-desk ticket — is in our [Threat Intelligence Center writeup](https://captechgroup.com/threat-intelligence-center/twinloot-malware-turns-microsoft-cloud-services-in-e04bf2). If you want to know what your own logs would and would not show after an incident like this, a [security assessment](https://captechgroup.com/security-assessment) is where that conversation starts. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-08-30T12:28:33Z", "datePublished": "2026-08-30T12:28:33Z", "description": "TWINLOOT malware hides its command traffic inside Microsoft 365, leaving no trace in your sign-in logs. What it means for professional-services firms.", "headline": "When Your Own Microsoft 365 Becomes the Attacker's Channel", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/resources\/blog\/when-your-microsoft-365-becomes-the-attackers-channel" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/resources\/blog\/when-your-microsoft-365-becomes-the-attackers-channel" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```