A previously undocumented malware family, named SynkLoader, is being distributed through phishing campaigns targeting Microsoft Teams users. The attacks aim to steal credentials by presenting victims with a deceptive lock screen.
The campaign involves attackers impersonating an organization's IT help desk, a tactic that Microsoft has previously identified as increasingly common in multi-stage attacks. Victims are directed to install a malicious PowerShell Cleaner executable (.MSI) that is hosted on Microsoft Azure, which lends an appearance of legitimacy to the download.
Analysis of the malware indicates that its initial compilation and distribution began around July 28, 2026. The installer extracts a PowerShell script, `cleaner.ps1`, along with a ZIP archive. This archive contains a Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs.
SynkLoader is notable for its complex architecture, often blending Python, PowerShell, C#, and C++ within a single module. The specific modules deployed by the attackers are tailored based on the profile of the breached environment and the operational objectives.
Researchers identified several SynkLoader modules, including a System Profiler that gathers details such as hostname, username, privilege level, running processes, services, domain information, and the number of computers in Active Directory. A Persistence Module creates a randomly named scheduled task to launch SynkLoader at user logon and daily at 10 a.m.
The PhishLocker module is a key component, designed to capture Windows account passwords by displaying a convincing, but fake, Windows lock screen. If successful, these credentials, combined with the tunneling capabilities of other modules, could allow attackers to access corporate environments from the infected device, potentially bypassing IP allow-list restrictions. While the fake lock screen appears authentic, it can be exposed as a full-screen, borderless GUI application by using Alt+Tab.
Another module, TrafficRedirector, establishes a reverse proxy, enabling attackers to access internal network services or route internet traffic through the compromised machine. An Interactive Shell (RAT) provides remote execution of PowerShell commands and output retrieval, while StreamMaster (VNC) allows for desktop streaming and remote control of the active session. A Module Status Script reports on currently running malware modules and associated threads.
The focus on Active Directory environment size suggests that SynkLoader may be used in conjunction with ransomware operations. Researchers confirmed the presence of a hands-on-keyboard attack capability through an emulator for the reverse shell module. Attackers attempted to run profiling commands before disconnecting upon realizing they were in a simulated environment.
Indicators of Compromise (IoCs) have been provided, though it's noted that SynkLoader module hashes are unique per infection, limiting their utility for defense. Best practices include independently verifying IT requests and avoiding the installation of unsolicited MSI files. When confronted with an unexpected lock screen, users should attempt Ctrl+Alt+Delete or Alt+Tab to verify its authenticity.
