A previously unknown malware family dubbed SynkLoader is being distributed through Microsoft Teams phishing campaigns, where attackers impersonate corporate IT help desks and direct victims to install a fake PowerShell Cleaner package hosted on Microsoft Azure.
The campaign is designed to make the download appear legitimate by abusing familiar workplace communication channels and trusted cloud infrastructure. Security researchers found that the malware can steal Windows credentials through a convincing fake lock screen and deploy additional modules based on the infected organisation’s environment.
Analysis of the malware indicated that it was first compiled and distributed around July 28, 2026. The installer extracts a PowerShell script named cleaner.ps1 along with a ZIP archive containing a Python framework, a malicious Python script, precompiled Python libraries and fake Microsoft runtime DLLs.
Malware Combines Multiple Tools for Remote Access and Persistence
SynkLoader stands out for its use of several programming technologies, including Python, PowerShell, C# and C++, with some modules combining as many as three languages.
Researchers identified multiple components that can be deployed depending on the targeted environment. One module profiles an infected system by collecting information such as the hostname, username, privilege level, running processes, services, domain details and the number of computers in Active Directory.
Another persistence component creates a randomly named scheduled task that launches SynkLoader when the user logs on and again each day at 10 a.m.
The malware also includes remote-access capabilities. An interactive shell allows attackers to execute PowerShell commands remotely, while another module can stream the victim’s desktop and provide remote mouse and keyboard control of an active session.
A traffic redirection component can create a reverse proxy, allowing attackers to reach internal network services or route internet traffic through an infected machine. Another script reports which SynkLoader modules and associated threads are active.
Fake Windows 11 Lock Screen Captures Passwords
One of the malware’s most notable components is a module called PhishLocker, which presents victims with a convincing fake Windows lock screen designed to capture their account passwords.
Once a password is obtained, attackers could potentially combine the stolen credentials with SynkLoader’s tunnelling capability to access corporate environments from the compromised device while bypassing IP allow-list restrictions.
Despite its convincing appearance, the fraudulent lock screen is a full-screen borderless application rather than a genuine Windows authentication interface. Researchers noted that pressing Alt+Tab can reveal active windows behind the fake lock screen, exposing the deception.
Researchers also suggested that the malware’s focus on measuring the size and structure of Active Directory environments could indicate its use in ransomware-related operations.
During analysis, researchers set up a honeypot that communicated with the attacker’s command-and-control infrastructure while posing as a legitimate victim. The threat actor reportedly attempted to run profiling commands before recognising that the system was not a genuine target and disconnecting.
Researchers Urge Users to Verify Unexpected IT Requests
Indicators of compromise were provided for the observed campaign, although researchers noted that SynkLoader uses unique module hashes for individual infections, limiting the usefulness of hash-based detection.
Users are advised to independently verify unexpected IT support requests, particularly those delivered through Microsoft Teams, and avoid installing unsolicited MSI files.
An unexpected Windows lock screen should also be treated with caution. Researchers advised users to try Ctrl+Alt+Delete or Alt+Tab to determine whether a lock screen is genuine.
The campaign shows how attackers can combine trusted collaboration platforms, cloud-hosted downloads, credential phishing and modular malware to penetrate corporate networks. By impersonating IT support staff and using familiar Microsoft services, the operators attempt to make malicious instructions appear routine while gaining credentials and deeper access to targeted systems.
