SynkLoader: New Malware Strikes Through Microsoft Teams Phishing

Expel has identified a previously unknown malware family dubbed SynkLoader that spreads through phishing campaigns on Microsoft Teams. The attackers impersonate the targeted organization's IT support desk — a tactic whose growing popularity Microsoft warned about as early as the beginning of the year.

How the attack works

The victim is persuaded to install a fake “PowerShell Cleaner” executable in MSI format, hosted on Microsoft Azure cloud — which makes the download look trustworthy. According to the researchers, judging by the compilation timestamps, the malware was first built and put into circulation around July 28, 2026.

The installer extracts a PowerShell script, cleaner.ps1, and a ZIP archive containing a Python framework, the malicious script, precompiled libraries and several fake DLLs that mimic Microsoft system components. SynkLoader got its name from its unusual mix of languages: Python, PowerShell, C# and C++ — and sometimes as many as three languages are blended within a single module.

A modular payload

By deploying a honeypot and posing as a real victim, Expel's analysts received a set of modules from the command-and-control server. Among them were System Profiler (which gathers data on the host, user, processes, services and the size of the Active Directory domain), a persistence module using a scheduled task, the TrafficRedirector reverse proxy, an interactive RAT shell and the StreamMaster VNC module for remote desktop control.

The most notable component is PhishLocker. It displays a convincing fake Windows lock screen and intercepts the password entered. With the credentials in hand, together with the tunneling module, the attackers can log into the corporate environment straight from the infected machine, bypassing IP-address restrictions.

The fake's weak spot

Despite its authentic appearance, the fake lock screen is nothing more than a borderless full-screen window. Simply pressing Alt+Tab brings any open windows on top of it and gives away the deception. Ctrl+Alt+Delete also helps verify the authenticity of an unexpected lock screen.

In the opinion of researcher Marcus Hutchins, SynkLoader's emphasis on gauging the scale of Active Directory points to its likely use in ransomware operations. The analysts wrote an emulator for the reverse-shell module and confirmed that this is a hands-on attack: the operator tried to run several reconnaissance commands but, realizing they had walked into a trap, disconnected.

Expel has published indicators of compromise, noting that the module hashes are unique to each infection and therefore of little use to defenders. The main recommendation remains the same: independently verify requests from the IT department and don't install unsolicited MSI files.

Source: Bleeping Computer