TWINLOOT uses SharePoint, Teams, Azure and the victim’s own Edge browser to hide command-and-control traffic inside trusted Microsoft infrastructure.

A Python-based malware framework is taking the concept of living off the land (LOTL) to a whole new level by operating its entire command-and-control (C2) from inside Microsoft Azure and 365 services, ...

With this new feature, users can type in Python code in the Excel app. The calculations are then run on a Microsoft cloud server and are returned to the Excel app, with plots and visualizations.