Security researchers at Expel have uncovered a new malware family, dubbed SynkLoader, being distributed through Microsoft Teams phishing campaigns. The attackers impersonate a target company’s IT help desk, a social engineering tactic Microsoft flagged earlier this year as increasingly common in multi-stage intrusions.

According to Expel researcher Marcus Hutchins, victims are directed to install a fake “PowerShell Cleaner” MSI installer hosted on Microsoft Azure, lending the download an appearance of legitimacy. Compile dates and file timestamps suggest the malware was first built and distributed around July 28, 2026.

The installer drops a PowerShell script named cleaner.ps1 along with a ZIP archive containing a Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs. The malware gets its name from its unusual mix of Python, PowerShell, C#, and C++, with some modules blending up to three languages at once.

Modular Toolkit

By running a honeypot that impersonated a legitimate victim and pinged the attacker’s command and control server, Expel identified several distinct SynkLoader modules, deployed selectively based on the compromised environment:

  • System Profiler: Collects hostname, username, privilege level, running processes, services, domain details, and Active Directory computer counts.
  • Persistence Module: Creates a randomly named scheduled task to relaunch the malware at logon and daily at 10 a.m.
  • PhishLocker: Displays a convincing fake Windows lock screen to capture the victim’s login password.
  • TrafficRedirector: Establishes a reverse proxy for reaching internal network services or routing internet traffic through the infected host.
  • Interactive Shell (RAT): Lets attackers remotely execute PowerShell commands and view the output.
  • StreamMaster (VNC): Streams the victim’s desktop and enables remote control of the active session.
  • Module Status Script: Reports which modules and threads are currently active.

The PhishLocker module stands out as the most notable component. By harvesting a valid Windows password, attackers can combine it with the tunneling module to reach corporate environments from the infected machine, bypassing IP allow-list restrictions. Despite its convincing appearance, Expel notes the lock screen is simply a full-screen borderless GUI application, and pressing Alt+Tab reveals active windows behind it.

Hutchins says SynkLoader’s emphasis on measuring the size of the Active Directory environment suggests it is likely used to support ransomware operations. Expel built an emulator for the reverse shell module and confirmed the attack involved hands-on-keyboard activity, observing the threat actor run several profiling commands before realizing they were in a decoy environment and disconnecting.

Defensive Guidance

Expel published indicators of compromise from the observed campaign but cautioned that SynkLoader module hashes are unique per infection and offer limited value for detection. Organizations are advised to independently verify unsolicited IT support requests, avoid installing unexpected MSI files, and treat unexplained lock screens with suspicion. Pressing Ctrl+Alt+Delete or Alt+Tab can help confirm whether a lock screen is legitimate.