SynkLoader uses Microsoft Teams phishing to steal passwords

Attackers are using Microsoft Teams phishing messages to deliver a previously unknown malware family called SynkLoader, posing as a company’s IT help desk and directing employees to install a fake “PowerShell Cleaner” package. Itzine reports that the campaign’s samples were first collected and distributed around July 28, 2026, while BleepingComputer reports that the installer was hosted in Microsoft Azure to make the download look more credible.

The payload arrives as an MSI file, a format commonly used for Windows software installation. Once opened, it extracts a PowerShell script named cleaner.ps1 and a ZIP archive containing a Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs.

SynkLoader combines Python, PowerShell, C# and C++, with some modules blending as many as three programming languages. Expel identified the malware while operating a honeypot that contacted the attackers' command-and-control server while presenting itself as a legitimate victim.

What SynkLoader can do after installation

The attackers choose modules based on the profile of the compromised environment and the goals of the operation. Expel identified components that can:

• Profile the system: collect the hostname, username, privilege level, running processes, services, domain information and the number of computers in Active Directory.
• Maintain persistence: create a randomly named Windows scheduled task that launches the malware when the user signs in and every day at 10 a.m.
• Redirect traffic: create a reverse proxy so attackers can reach internal network services or route internet traffic through the infected computer.
• Provide an interactive shell: remotely execute PowerShell commands and receive their output.
• Stream the desktop: use the StreamMaster VNC module to view the victim’s desktop and control the active session with the mouse and keyboard.
• Report module status: identify which malware components and related threads are currently running.

The most direct credential-theft mechanism is PhishLocker. It displays a fake Windows lock screen and asks the victim to enter their Windows account password. The attackers can then combine the stolen password with SynkLoader’s tunneling capability to access corporate services from the infected device, potentially bypassing IP allow-list restrictions.

The lock screen is a full-screen, borderless application, not a genuine Windows security screen. Expel says pressing Alt+Tab reveals active windows over the fake interface. Ctrl+Alt+Delete can also help users determine whether the lock screen is authentic.

Why the campaign may target ransomware victims

Expel researcher Marcus Hutchins said SynkLoader’s focus on measuring the size of an organization’s Active Directory environment points toward possible use in ransomware operations. The system-profile module gives operators information about the domain and the number of connected computers before they decide which capabilities to activate.

Expel also confirmed that the reverse shell supported hands-on-keyboard activity rather than being limited to automated collection:

“We did end up writing an emulator for the reverse shell module, just to confirm it was actually a hands-on-keyboard attack. The threat actor attempted to run several profiling commands before realizing they were not in a real environment and disconnecting.”

That combination—credential theft, internal-network tunneling, remote command execution, desktop control and environment profiling—turns a single Teams conversation into a possible route toward broader corporate access. It also fits the wider security problem of attackers using legitimate credentials after initial compromise, a pattern covered in our reporting on why valid logins are becoming a cybersecurity risk.

Expel supplied indicators of compromise, but warned that SynkLoader’s module hashes are unique to each infection, limiting their usefulness as a standalone detection method. Defenders should therefore avoid relying only on static hashes.

The practical guidance is straightforward: independently verify unexpected requests from IT support, and do not install unsolicited MSI files. If a sudden Windows lock screen appears, test it with Alt+Tab or Ctrl+Alt+Delete rather than entering a password.