A new malware family called SynkLoader is being distributed through phishing campaigns targeting Microsoft Teams users. The malware uses a fake lock screen to steal victim credentials. The campaign represents a previously unknown malware family, suggesting a new threat actor or toolset. Microsoft Teams is being exploited as a delivery vector, likely leveraging its widespread enterprise adoption. The attack methodology involves social engineering through Teams messages to lure users into interacting with the malicious payload. Credential theft via fake lock screens is a classic but effective technique adapted for the Teams platform. Organizations using Microsoft Teams should be vigilant about unsolicited messages and unexpected authentication prompts.
SynkLoader is a previously unknown modular malware family first compiled and distributed around July 28, 2026. It is distributed via Microsoft Teams phishing campaigns where attackers impersonate the target company's IT help desk. Victims are directed to install a fake 'PowerShell Cleaner' executable (.MSI file) hosted on Microsoft Azure to appear trustworthy. The MSI installer extracts a PowerShell script (cleaner.ps1) and a ZIP archive containing the Python framework, a malicious Python script, precompiled Python libraries, and fake Microsoft runtime DLLs. SynkLoader is notable for combining Python, PowerShell, C#, and C++ — sometimes blending up to three languages in a single module. Modules identified include: (1) System Profiler — collects hostname, username, privilege level, running processes, services, domain details, and Active Directory computer count; (2) Persistence Module — creates a randomly named scheduled task launching SynkLoader at user logon and daily at 10 a.m.; (3) PhishLocker — displays a fake Windows lock screen to capture the user's login password; (4) TrafficRedirector — creates a reverse proxy for internal network access or routing traffic through the infected host; (5) Interactive Shell (RAT) — allows remote PowerShell command execution; (6) StreamMaster (VNC) — streams the victim's desktop and enables remote mouse/keyboard control; (7) Module Status Script — reports which modules and threads are running. The PhishLocker fake lock screen is a full-screen borderless GUI application that can be exposed by pressing Alt+Tab. SynkLoader's focus on Active Directory environment profiling suggests use in ransomware operations. Module hashes are unique per infection, limiting hash-based detection. A honeypot revealed the threat actor conducted hands-on-keyboard activity with profiling commands before detecting the non-real environment and disconnecting.
1. Independently verify IT help desk requests before installing any software, especially unsolicited MSI files. 2. Do not install software requested via Microsoft Teams messages from unverified sources. 3. When encountering an unexpected lock screen, press Ctrl+Alt+Delete or Alt+Tab to verify its authenticity. 4. Monitor for suspicious scheduled tasks created at user logon or with daily triggers. 5. Look for unexpected MSI installations originating from Microsoft Azure-hosted URLs. 6. Monitor for PowerShell scripts such as cleaner.ps1 being executed. 7. Alert on processes spawning Python interpreters alongside PowerShell in unusual contexts. 8. Monitor network traffic for reverse proxy or tunneling behavior from endpoints. 9. Audit Active Directory for unexpected enumeration activity. 10. Train users to recognize IT helpdesk impersonation attacks on Microsoft Teams.
Fake MSI file disguised as 'PowerShell Cleaner' hosted on Microsoft Azure, PowerShell script named cleaner.ps1, ZIP archive containing Python framework, malicious Python script, precompiled Python libraries, and fake Microsoft runtime DLLs, Randomly named scheduled task launching SynkLoader at user logon and daily at 10:00 AM, Note: SynkLoader module hashes are unique per infection and not reliable IOCs
