TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

thehackernews.com Aug 18, 2026

TWINLOOT Abuses SharePoint and Teams to Steal Credentials and Move Across Networks

Curated by Shubham · TechCapsules · Aug 18, 2026

AI-summarised brief · reviewed before publication

Cybersecurity researchers uncovered TWINLOOT, a Python-based implant that hijacks Microsoft 365 services for command‑and‑control. The malware uses SharePoint Online dead‑drops, Microsoft Teams TURN servers, and a headless Edge browser to blend malicious traffic with legitimate activity. It harvests Windows credentials via fake lock screens, establishes a reverse SOCKS5 tunnel for lateral movement, and can execute arbitrary commands and maintain persistence. The tool was discovered during an investigation into a July 2026 campaign attributed to the Chaos ransomware group.

💡 Why It Matters

· TWINLOOT’s exploitation of trusted cloud services reveals a new vector that bypasses traditional perimeter defenses, forcing security teams to scrutinize legitimate Microsoft traffic for hidden malicious activity.

Read full article on thehackernews.com

Clop-Linked Windchill Web Shell Decrypts Credentials and Maps Engineering Data

A bespoke JavaServer Pages web shell, linked to the Clop ransomware group, was deployed after exploiting CVE‑2026‑12569 in PTC Windchill and FlexPLM servers. The shell decrypts all Windchill keystore credentials, maps the application’s file vault, and can execute arbitrary Java code via a custom class loader. It enables rapid lateral movement, data exfiltration, and persistence without additional tools, targeting engineering data and LDAP credentials that could compromise entire enterprise networks. The attack demonstrates a tailored, application‑specific threat model.

💡 The shell’s ability to harvest privileged credentials in one step turns a single PLM breach into a full‑network compromise, exposing sensitive product designs and corporate infrastructure. Its custom design bypasses traditional defenses, underscoring the need for targeted monitoring of critical PLM environments.

ign.com · Aug 19

The Pokémon Company Cancels 30th Anniversary Card Orders Following ‘Cyber Incident,’ Warns…

The Pokémon Company has cancelled all 30th Anniversary Card orders linked to a cyber incident that exposed customer data. The breach involved CEVA, the logistics partner handling European shipments, and may have compromised names, addresses, phone numbers, emails, and order contents. Pokémon Center staff notified affected customers via email, explaining the data exposure. The company has not clarified why orders were cancelled or the extent of the impact, leaving many pre‑orders voided. The incident adds to ongoing concerns over card scarcity and scalping.

💡 The cancellation signals a severe breach of consumer trust, potentially eroding confidence in Pokémon’s digital sales channels. It also underscores the vulnerability of third‑party logistics in protecting personal data.

infosecurity-magazine.com · Aug 19

European Space Agency Confirms Server Breach

Europe’s space agency confirmed that hackers accessed servers outside its corporate network last month, compromising data used for unclassified collaborative engineering. ESA said a forensic analysis is underway and only a small number of external servers appear affected. The breach was first hinted at in a BreachForums post on Dec. 18, where a threat actor claimed to have exfiltrated over 200 GB, including private Bitbucket repositories, source code, CI/CD pipelines, API tokens, configuration files and hard‑coded credentials. ESA has informed stakeholders, secured potentially affected devices and will issue updates. Experts warn the stolen information could enable supply‑chain attacks, underscoring the growing attack surface of distributed space‑technology collaborations and the sector’s struggle to meet EU cybersecurity mandates and to protect future mission data.

💡 The incident proves that seemingly low‑value engineering data can serve as a gateway for deeper supply‑chain sabotage, compelling space agencies to tighten security around open‑collaboration frameworks.

prnewswire.co.uk · Aug 19

Bybit Strengthens Security Defences Against Evolving Crypto Threats, Intercepting $700 Million in…

Bybit, the world’s second‑largest crypto exchange, released its H1 2026 Risk & Security Report detailing a multi‑layered defense upgrade after a February 2025 hack that stole roughly $1.46 billion. The new system combines user‑account safeguards, full‑coverage on‑chain monitoring and AI‑assisted threat detection to shorten detection‑to‑response times. In the first half of 2026 the platform blocked over 30,000 dubious withdrawal attempts, shielding nearly 20,000 users from more than $700 million in potential losses, with an average initial review of 4.7 minutes and 95 % completed within ten minutes. Bybit also flagged $212 million in suspicious on‑chain funds, blacklisted over 10,000 malicious addresses, and handled ten token‑project security incidents without any platform losses, often acting faster than rival exchanges.

💡 Bybit’s rapid, AI‑driven interception demonstrates that real‑time, data‑centric security can materially protect users and curb fraud in a market where billions are routinely targeted.

thehackernews.com · Aug 19

StopAndProtect Uses Nearly 2,000 Hacked WordPress Sites to Spread Malware and Steal…

Check Point Research has uncovered a global cybercrime operation dubbed StopAndProtect that hijacks nearly 2,000 WordPress sites to deliver a multi‑component malware toolkit. The campaign begins with a ClickFix‑style social‑engineering prompt that triggers a PowerShell command, launching .NET downloaders and loaders which install ransomware, a SMB/USB worm, lock‑screen modules, a VBS spreader, a chat utility and credential stealers. The actors also exfiltrate files, screenshots and WhatsApp data, using a custom WordPress MU plugin that permits arbitrary file uploads and remote code execution. Researchers observed operational‑security mistakes that exposed infection logs and over 700 data archives, including internal development tools. Most compromised sites run outdated WordPress versions with dozens of known vulnerabilities, facilitating the fake CAPTCHA injection against unsuspecting visitors worldwide.

💡 By turning compromised blogs into a distributed malware delivery network, the attackers bypass traditional defenses and reach victims directly through trusted web traffic, dramatically widening the attack surface.

infosecurity-magazine.com · Aug 19

Web3 Platform Mixin Network Hit by $200m Crypto Hack

Hong Kong‑based decentralized finance project Mixin Network disclosed a cyber‑attack that compromised its cloud service provider’s database on September 23, 2023, resulting in the loss of roughly $200 million in cryptocurrency. The breach forced the platform to suspend deposit and withdrawal services while transfers remained operational, and Mixin enlisted Google and blockchain security firm SlowMist to investigate. Founder Feng Xiaodon addressed users in a live Mandarin briefing on September 25, outlining remediation steps, and the project later reported a $30 million drop in total value locked, according to DeFi Llama. Launched in 2017, Mixin’s XIN token supports cross‑chain transactions for about 10,000 DApps. The incident ranks as the fifth‑largest crypto hack outside exchanges, trailing incidents such as Ronin, Poly Network, BNB Bridge and Wormhole.

💡 The hack exposes the vulnerability of “decentralized” platforms that still depend on centralized cloud infrastructure, challenging the core security premise of Web3.