A newly identified threat called SynkLoader malware is spreading through Microsoft Teams phishing campaigns. Attackers impersonate corporate IT help desks and try to convince employees to install a fake software tool.
Researchers at Expel said the campaign directs victims to a malicious MSI installer presented as a “PowerShell Cleaner.” The file is hosted in Microsoft Azure, which can make the download appear more trustworthy.
Fake IT requests lead to malicious installer
The attackers contact targets through Microsoft Teams while posing as their organisation’s IT support team. Help-desk impersonation has become a common tactic in multi-stage attacks, as it gives criminals a direct route to employees.
The installer extracts a PowerShell script and a ZIP archive containing a Python framework, malicious scripts, compiled libraries and fake Microsoft runtime files.
Researchers said the malware appears to have first been compiled and distributed around July 28, 2026.
SynkLoader combines several programming languages
SynkLoader malware gets its name from its unusual technical design. Its modules can combine Python, PowerShell, C# and C++, sometimes using three programming languages in one component.
The malware deploys different modules depending on the victim’s environment and the attackers’ goals.
A system-profiling module collects details including the computer name, username, privilege level, running processes, services and Active Directory information. It can also check the size of the organisation’s network.
Another component creates a scheduled task with a random name. This task launches the malware when the user signs in and again each day at 10 a.m., giving the attackers a way to maintain access.
Fake lock screen steals Windows passwords
The most notable SynkLoader component is called PhishLocker. It displays a convincing fake Windows lock screen and attempts to capture the victim’s account password.
Once attackers obtain the password, they could pair it with the malware’s network-tunnelling tools to access internal corporate services. This may help them bypass IP allow-list restrictions that would otherwise block unfamiliar connections.
The fake screen is not a genuine Windows security feature. It is a full-screen application, meaning users may expose the windows behind it by pressing Alt+Tab.
Remote access modules can deepen the intrusion
SynkLoader includes several tools that give attackers broad control over an infected machine. A reverse-proxy module can expose internal services or route internet traffic through the victim’s computer.
The malware also includes an interactive remote shell for running PowerShell commands. Its VNC component can stream the desktop and give attackers control of the mouse and keyboard.
Expel researchers said SynkLoader’s focus on Active Directory profiling suggests that the operators may use it in ransomware-related attacks. Measuring the size and structure of a corporate network can help criminals identify valuable targets.
How to reduce the risk from Teams phishing
Employees should independently verify unexpected IT requests, especially messages that ask them to download or install software. A genuine support team should be able to confirm the request through a known company channel.
Users should not install unsolicited MSI files, even when a link appears to come from a trusted cloud service.
If an unexpected lock screen appears, pressing Ctrl+Alt+Delete or Alt+Tab can help determine whether it is a real Windows screen or a malicious application. Security teams should also investigate unexpected scheduled tasks, suspicious PowerShell activity and unusual remote-access connections.
0 responses to “SynkLoader Malware Uses Teams Phishing and Fake Lock Screen”