A new malware family, called SynkLoader, is being spread through Microsoft Teams phishing campaigns. And it aims to steal user login details using fake Windows lock screens. This modular threat mixes several programming languages, and it shows a growing danger in corporate security. Because attackers use trusted communication platforms to break into organizations. This guide covers the new SynkLoader malware pushed in Microsoft Teams phishing campaigns in detail.
Security researchers at Expel, led by principal threat researcher Marcus Hutchins, found SynkLoader. While looking into an endpoint detection and response (EDR) alert on a client network. The malware's compile dates and file timestamps show it was first built and. Sent out around July 28, 2026. The attack chain usually starts with an attacker pretending to be an organization's IT help desk. And Microsoft itself pointed this out earlier this year as more common in multi-stage intrusions. These bad actors often reach out from external Microsoft 365 trial tenants. Which makes their messages look real within the Teams environment.
New SynkLoader malware pushed in Microsoft Teams phishing campaign: How Does SynkLoader Infiltrate and Operate?
Victims are tricked into downloading and installing a fake "PowerShell Cleaner" file (.MSI) hosted on Microsoft Azure Blob Storage, which gives the malicious payload a sense of trust. Once run, the installer pulls out a PowerShell script (cleaner.ps1) and a ZIP archive that contains a self-contained Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs. SynkLoader got its name from its unusual mix of programming languages, including Python, PowerShell, C#, and C++, and it often blends up to three in a single module to avoid detection.
The PhishLocker Module: A Credential Thief's Best Friend
The most alarming part of SynkLoader is its PhishLocker module. Which shows a very convincing fake Windows lock screen to capture user login passwords. This module gets the current username and Windows lock-screen background. And then it shows a password field designed to trick the user into. Typing their real credentials. By getting these passwords, attackers can combine them with the tunneling module to. Access corporate environments from the infected device. Which can bypass IP allow-list restrictions and other security measures. While the screen looks real, Expel notes a key flaw. Because pressing Alt+Tab can show the active windows beneath the fake lock screen. Which reveals it is just a full-screen borderless GUI app, not a real system prompt.
What This Means for Tech Readers
The rise of SynkLoader shows a key shift in how cyberattacks work. Because attackers now move past traditional email phishing and exploit trusted collaboration platforms like Microsoft Teams. The advanced multi-language setup and modular design of SynkLoader make it a strong threat. That can deeply infiltrate and keep access over time. Marcus Hutchins suggests that SynkLoader's focus on measuring Active Directory environment size strongly. Points to its use in ransomware operations. And it may also be used by initial-access brokers, who sell access to compromised networks. This type of human-operated attack relies heavily on social engineering and the abuse of legitimate tools. So it is hard to detect with standard security measures. Organizations must recognize that their internal communication channels are now prime targets for advanced social engineering. And they need greater watchfulness from employees and strong, multi-layered security defenses.
What's Next in the Fight Against SynkLoader?
Defending against threats like SynkLoader needs a multi-pronged approach because attackers keep changing their methods. Organizations should put independent verification of all IT requests first, especially those. That ask for software installations, and they should also strictly avoid installing unsolicited MSI files. Employees should learn to spot the signs of phishing attempts within Microsoft Teams. Which includes external sender warnings and suspicious requests. When faced with an unexpected lock screen, users should try Ctrl+Alt+Delete or Alt+Tab. To check if it is real. Strong endpoint detection and response (EDR) solutions are also key because they help monitor unusual process activity, such as pythonw.exe or PowerShell commands run in memory. And they also help check randomly named scheduled tasks. That SynkLoader uses to stay on the system. As threat actors keep coming up with new tricks, security strategies must change. To protect against not just technical exploits. But also the more advanced social engineering tactics that get past traditional perimeter defenses.
