TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

The Python-based malware framework takes living-off-the-land tactics to a new heights of stealth, with a modular implant that steals credentials and achieves persistence.