New SynkLoader malware pushed in Microsoft Teams phishing campaign

Summary

A new malware family named SynkLoader is being distributed through phishing campaigns on Microsoft Teams, impersonating IT help desks. The malware, which uses a mix of Python, PowerShell, C#, and C++, deploys modules to steal system information, establish persistence, capture user passwords via a fake lock screen, and provide remote access.

Full text

New SynkLoader malware pushed in Microsoft Teams phishing campaign By Bill Toulas August 21, 2026 02:01 PM 0 A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. The attacker impersonates the target company's IT help desk, a tactic Microsoft highlighted earlier this year as increasingly common in multi-stage attacks. Expel’s security researcher Marcus Hutchins explains that the attacks direct the victim to install a fake “PowerShell Cleaner” executable (.MSI) hosted in Microsoft Azure, making the download appear trustworthy. Analysis of the malware showed "compile dates and file timestamps indicating it was first compiled and distributed around July 28, 2026." The installer extracts a PowerShell script named cleaner.ps1 and a ZIP archive containing the Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs. SynkLoader ZIP archive content source: Expel Based on the breached environment profile and operational targets, the attackers select which modules to deploy. SynkLoader was named as such because of its unusual combination of Python, PowerShell, C#, and C++, sometimes blending up to three programming languages in a single module. Expel identified the following SynkLoader modules after setting up a honeypot pinging the attacker’s C2, posing as a legitimate victim: System Profiler — Collects the hostname, username, privilege level, running processes, services, domain details, and number of computers in Active Directory. Persistence Module — Creates a randomly named scheduled task that launches SynkLoader at user logon and daily at 10 a.m. PhishLocker — Displays a convincing fake Windows lock screen to capture the user’s login password. TrafficRedirector — Creates a reverse proxy that lets attackers reach internal network services or route internet traffic through the infected computer. Interactive Shell (RAT) — Allows attackers to remotely execute PowerShell commands and receive their output. StreamMaster (VNC) — Streams the victim’s desktop and enables remote mouse and keyboard control of the active session. Module Status Script — Reports which malware modules and associated threads are currently running. The malicious task securing persistenceSource: Expel Fake Windows 11 lock screen The most interesting component of SynkLoader is the PhishLocker module, which attempts to obtain the victim’s Windows account password via a fake lock screen. By obtaining the password, the attackers could use it alongside the tunneling module to access corporate environments from the infected device, bypassing IP allow-list restrictions. Although the fake lock screen looks particularly convincing, Expel notes that simply using Alt+Tab exposes the active windows on top of the lock screen which is just a "full-screen borderless GUI application." Alt+Tab exposing the deceptive lock screenSource: Expel Hutchins says that based on SynkLoader’s focus on measuring Active Directory environment size, it’s likely that it’s used in ransomware operations. “We did end up writing an emulator for the reverse shell module, just to confirm it was actually a hands-on-keyboard attack,” the researcher says. “The threat actor attempted to run several profiling commands before realizing they were not in a real environment and disconnecting.” Expel provided indicators of compromise (IoCs) for the observed attack, though it noted that the SynkLoader module hashes are unique for each infection and therefore not very useful for defenders. The best practice would be to verify IT requests independently and avoid installing unsolicited MSI files. When met with an unexpected lock screen, try Ctrl+Alt+Delete or Alt+Tab to determine its authenticity. Once attackers have valid credentials, only 37% of their actions are blocked Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report Related Articles: Fake IT support calls on Microsoft Teams push EtherRAT malwareMicrosoft blames Windows gaming issues on RGB lighting devicesHackers abuse FTP server banners to deliver new Windows malwareMicrosoft says August Windows updates may cause gaming issuesNew Manic Android malware can exfiltrate data through nearby devices

Indicators of Compromise

• malware — SynkLoader
• mitre_attack — T1059.001
• mitre_attack — T1059.003
• mitre_attack — T1547.001
• mitre_attack — T1078.002
• mitre_attack — T1090.002
• mitre_attack — T1082

Entities