A newly identified malware family called SynkLoader is being distributed through Microsoft Teams phishing campaigns designed to steal credentials via a fake lock screen, according to research from security firm Expel. The attacks impersonate the target company’s IT help desk, a tactic Microsoft has flagged as increasingly common in multi-stage intrusions. Expel researcher Marcus Hutchins detailed the campaign, which directs victims to install a malicious “PowerShell Cleaner” executable hosted in Microsoft Azure to make the download seem trustworthy.
The malicious installer, an MSI file, extracts a PowerShell script named cleaner.ps1 along with a ZIP archive containing a Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs. Compile dates and file timestamps in the malware indicate it was first built and distributed around July 28, 2026. The attackers choose which modules to deploy based on the breached environment’s profile and operational targets. SynkLoader’s name comes from its unusual mix of Python, PowerShell, C#, and C++, with some modules blending up to three programming languages.
Expel identified several SynkLoader modules after setting up a honeypot that pinged the attacker’s command-and-control server while posing as a legitimate victim. The most notable module, PhishLocker, attempts to capture the victim’s Windows account password through a convincing fake lock screen. If successful, the attackers could combine that password with a tunneling module to access corporate networks from the infected device, bypassing IP allow-list restrictions. While the fake lock screen appears realistic, Expel notes that pressing Alt+Tab exposes the active windows on top of it, revealing it as a full-screen borderless GUI application rather than a genuine system screen.
Hutchins said SynkLoader’s focus on measuring Active Directory environment size suggests it is likely used in ransomware operations. The researcher also noted that Expel built an emulator for the malware’s reverse shell module to confirm it was a hands-on-keyboard attack. The threat actor attempted to run several profiling commands before recognizing they were not in a real environment and disconnecting.
Expel provided indicators of compromise for the observed attacks but cautioned that the module hashes are unique for each infection, limiting their usefulness for defenders. The firm recommends verifying IT requests independently and avoiding unsolicited MSI files. Users who encounter an unexpected lock screen should try Ctrl+Alt+Delete or Alt+Tab to check whether it is legitimate.
The research comes alongside Expel’s Blue Report 2026, which measures defense effectiveness technique by technique across 338 million simulations run in customer production environments. The report highlights that overall prevention scores can hide what occurs after initial access, as prevention drops sharply once attackers use valid credentials. This campaign underscores the growing risk of multi-stage phishing attacks that leverage trusted communication platforms like Microsoft Teams.
More cybersecurity news from TechManNews.
