A previously unknown malware family dubbed SynkLoader is being distributed through Microsoft Teams phishing campaigns, where attackers impersonate corporate IT help desks and direct victims to install a fake PowerShell Cleaner package hosted on Microsoft Azure.
Abusing Trusted Workplace Tools
This campaign is designed to make the download appear legitimate by abusing familiar workplace communication channels and trusted cloud infrastructure. Security researchers found that the malware can steal Windows credentials through a convincing fake lock screen and deploy additional modules based on the infected organisation's environment.
Analysis of the malware indicated it was first compiled and distributed around July 28, 2026. The installer extracts a PowerShell script named cleaner.ps1, along with a ZIP archive containing a Python framework, a malicious Python script, precompiled Python libraries, and fake Microsoft runtime DLLs designed to blend in with legitimate system files.
A Malware Built From Multiple Programming Languages
SynkLoader stands out for its use of several programming technologies, including Python, PowerShell, C#, and C++, with some modules combining as many as three languages within a single component. Researchers identified multiple modules that can be deployed depending on the targeted environment.
One module profiles an infected system by collecting information such as the hostname, username, privilege level, running processes, services, domain details, and the number of computers in Active Directory, essentially mapping out the network before deciding how to proceed. Another persistence component creates a randomly named scheduled task that launches SynkLoader whenever the user logs on, and again each day at 10 a.m., ensuring the malware keeps running even after a reboot or logout.
The malware also includes genuine remote-access capabilities. An interactive shell allows attackers to execute PowerShell commands remotely, while another module can stream the victim's desktop and provide remote mouse and keyboard control of an active session. A traffic redirection component can create a reverse proxy, allowing attackers to reach internal network services or route internet traffic through an infected machine, and another script simply reports which SynkLoader modules and associated threads are currently active.
A Fake Windows Lock Screen Steals Passwords
One of the malware's most notable components is a module called PhishLocker, which presents victims with a convincing fake Windows lock screen designed specifically to capture their account passwords.
Once a password is obtained, attackers could potentially combine these stolen credentials with SynkLoader's tunnelling capability to access corporate environments from the compromised device, while bypassing IP allow-list restrictions that might otherwise block unauthorised access.
Despite its convincing appearance, the fraudulent lock screen is actually a full-screen borderless application rather than a genuine Windows authentication interface. Researchers noted that pressing Alt+Tab can reveal active windows behind the fake lock screen, exposing the deception if a user knows to check.
Researchers also suggested that the malware's focus on measuring the size and structure of Active Directory environments could indicate its use in ransomware-related operations, given that mapping out network scale is a common precursor step before larger-scale attacks.
During analysis, researchers set up a honeypot that communicated with the attacker's command-and-control infrastructure while posing as a legitimate victim. The threat actor reportedly attempted to run profiling commands before recognising that the system wasn't a genuine target, and subsequently disconnected.
How to Protect Yourself
Indicators of compromise were provided for the observed campaign, though researchers noted that SynkLoader uses unique module hashes for individual infections, limiting the usefulness of hash-based detection for identifying future variants.
Users are advised to independently verify unexpected IT support requests, particularly those delivered through Microsoft Teams, and to avoid installing unsolicited MSI files, regardless of how legitimate the request might appear.
An unexpected Windows lock screen should also be treated with caution. Researchers advised users to try Ctrl+Alt+Delete or Alt+Tab to determine whether a lock screen is genuine before entering any credentials.
This campaign shows how attackers can combine trusted collaboration platforms, cloud-hosted downloads, credential phishing, and modular malware to penetrate corporate networks. By impersonating IT support staff and using familiar Microsoft services, the operators attempt to make malicious instructions appear routine, while gaining credentials and deeper access to targeted systems.
FAQs
Q1. How is SynkLoader malware being distributed?
SynkLoader spreads through Microsoft Teams phishing campaigns, where attackers impersonate corporate IT help desks and direct victims to install a fake PowerShell Cleaner package hosted on Microsoft Azure.
Q2. How does the fake lock screen component steal passwords?
A module called PhishLocker displays a convincing fake Windows lock screen that captures victims' account passwords, though it can be exposed by pressing Alt+Tab, since it's actually a borderless application rather than a genuine authentication interface.
Q3. What should users do if they receive an unexpected IT support request?
Users should independently verify any unexpected IT support requests, especially those received through Microsoft Teams, avoid installing unsolicited MSI files, and use Ctrl+Alt+Delete or Alt+Tab to verify whether a lock screen is genuine.