SynkLoader Malware Pushed Through Microsoft Teams Phishing Campaigns, Steals Credentials and More
A sophisticated malware campaign has been uncovered, using Microsoft Teams to distribute a previously unknown malware family called SynkLoader. The attackers use phishing tactics, impersonating IT help desks, to trick victims into installing a fake “PowerShell Cleaner” executable hosted on Microsoft Azure. Once installed, the malware steals credentials by displaying a convincing fake Windows lock screen, among other malicious activities.
The campaign was discovered by Expel’s security researcher Marcus Hutchins, who explained that the attacks direct victims to install the executable, making it appear trustworthy due to its hosting on Microsoft Azure. The installer extracts several components, including a PowerShell script and a ZIP archive containing Python libraries, fake Microsoft runtime DLLs, and a malicious Python script. The attackers then select which modules to deploy based on the breached environment profile and operational targets.
SynkLoader is notable for its unusual combination of programming languages, blending up to three languages in a single module. Expel identified several SynkLoader modules after setting up a honeypot to ping the attacker’s command-and-control server, posing as a legitimate victim. These modules include:
System Profiler: Collects system details, including hostname, username, privilege level, and more.
Persistence Module: Creates a scheduled task that launches SynkLoader at user logon and daily at 10 a.m.
PhishLocker: Displays a convincing fake Windows lock screen to capture the user’s login password.
TrafficRedirector: Creates a reverse proxy for attackers to reach internal network services or route internet traffic through the infected computer.
The PhishLocker module is particularly concerning, as it attempts to obtain the victim’s Windows account password via a fake lock screen. By obtaining this information, attackers could use it alongside the tunneling module to access corporate environments from the infected device, bypassing IP allow-list restrictions.
Expel notes that simply using Alt+Tab exposes the active windows on top of the lock screen, which is just a “full-screen borderless GUI application.” Hutchins also suggests that SynkLoader’s focus on measuring Active Directory environment size indicates it may be used in ransomware operations.
To prevent falling victim to this type of attack, cybersecurity experts recommend verifying IT requests independently and avoiding installing unsolicited MSI files. If an unexpected lock screen appears, try Ctrl+Alt+Delete or Alt+Tab to determine its authenticity.
Source: Bleeping Computer — 2026-08-21