The SynkLoader campaign is an important example of how phishing is moving beyond email and into collaboration platforms that employees naturally trust. According to research reported by BleepingComputer, attackers are impersonating corporate IT help desks through Microsoft Teams and convincing employees to install what is presented as a “PowerShell Cleaner.” The malicious installer is delivered as an MSI package hosted on Microsoft Azure, which gives the download an additional appearance of legitimacy. Once executed, the installer deploys a newly identified malware framework called SynkLoader that combines PowerShell, Python, C# and C++ components to provide credential theft, persistence, remote access and network pivoting capabilities.

The delivery method is particularly significant because it exploits organisational trust rather than a software vulnerability. Microsoft Teams allows users from external organisations to communicate with internal users under certain configurations, and attackers are increasingly abusing this capability to pose as IT support personnel. Expel reported that Microsoft Teams phishing accounted for much of the sharp rise in targeted endpoint incidents it observed during June 2026, with attackers repeatedly targeting organisations over periods of days or even weeks. The pattern is effective because a Teams conversation appearing to come from technical support feels more immediate and internal than a conventional phishing email, making users more willing to follow instructions or install software.

SynkLoader itself appears to have been first compiled and distributed around July 28, 2026. Once the fake cleaner MSI is installed, it extracts a PowerShell script named `cleaner.ps1` along with a ZIP archive containing a Python runtime, malicious Python code, precompiled libraries and several files designed to resemble legitimate Microsoft runtime DLLs. This architecture allows the attackers to load different components depending on the victim environment rather than deploying every malicious capability at once. Such modularity makes the malware more flexible and potentially less detectable because an infected workstation receives only the functionality the attacker considers useful.

One of the first modules is a system profiler that collects information such as the computer hostname, logged-in username, privilege level, running processes, services, Windows domain details and even the number of computers present in Active Directory. This information is valuable because it helps the attacker determine whether the compromised organisation is worth pursuing further. A small standalone workstation may receive very different treatment from a machine connected to an enterprise domain containing hundreds or thousands of computers. The specific effort to determine Active Directory size is one reason researchers believe SynkLoader may ultimately support ransomware operations.

The persistence module ensures that the malware survives ordinary user activity and system restarts. SynkLoader creates a randomly named scheduled task that executes the malware whenever the user logs in and again every day at 10 a.m. Scheduled tasks are popular among attackers because they use legitimate Windows functionality and can therefore blend into the large number of normal scheduled activities present on enterprise systems. Security teams should consequently monitor the creation of new scheduled tasks, particularly those launching scripts, Python runtimes or executables from user-writable or temporary directories.

The most unusual component is PhishLocker, which displays a highly convincing imitation of the Windows 11 lock screen. Instead of exploiting Windows authentication directly, the malware attempts to persuade the user to type their real Windows password into the fake interface. The credentials entered by the victim can then be captured by the attacker. This is essentially credential phishing moved from a fake website onto the victim's own desktop. Because users naturally expect Windows to request their password after the screen has been locked, the attacker exploits an extremely familiar interface rather than asking the victim to sign into an obviously unrelated website.

Fortunately, the fake lock screen is not actually the Windows secure desktop. Expel notes that pressing Alt+Tab reveals other application windows because PhishLocker is simply a borderless full-screen graphical application. Ctrl+Alt+Delete can similarly help users verify whether they are interacting with the genuine Windows security interface. This provides a useful awareness lesson for employees: if an unexpected lock screen appears immediately after installing software or communicating with someone claiming to be IT support, users should avoid entering their credentials and instead use Ctrl+Alt+Delete or Alt+Tab to verify whether the screen is genuine.

Credential theft becomes considerably more powerful when combined with SynkLoader's TrafficRedirector module. This component establishes a reverse proxy through the compromised workstation, potentially allowing attackers to reach internal network services or route external traffic through the infected computer. The attacker's traffic can therefore originate from a legitimate corporate endpoint rather than an obviously malicious Internet address. If an organisation protects internal resources using IP allow lists or assumes that connections originating from corporate devices are trustworthy, the attacker may be able to inherit that trust indirectly.

The combination of PhishLocker and TrafficRedirector is especially dangerous. The attacker can potentially obtain the user's real Windows password and simultaneously use the victim's computer as the network entry point. Instead of attempting to log in from an unfamiliar overseas IP address that identity security controls might immediately reject, the attacker can originate activity from the already compromised corporate workstation. This demonstrates why IP-based trust should never be treated as equivalent to identity. An allowed address tells us where a connection appears to originate; it does not prove who is controlling the system behind that address.

SynkLoader also includes an interactive remote shell that allows attackers to execute PowerShell commands and retrieve the results. Expel researchers created an emulator for this component and observed attackers interacting manually with what they believed was a real victim environment. The operator executed several profiling commands before recognising that the environment was a honeypot and disconnecting. This is important because it demonstrates that the campaign is not purely automated malware distribution. Human operators appear to evaluate compromised networks and can adapt their actions based on what they discover.

Another module, StreamMaster, provides VNC-style remote desktop capability. It can stream the victim's desktop to the attacker and allow remote mouse and keyboard interaction with the active user session. This gives the attacker the ability to operate legitimate applications exactly as the user would. Remote desktop control is particularly challenging for defenders because malicious activity may occur through authorised software and an already authenticated session rather than through obvious malware commands. An attacker can potentially browse internal applications, access file shares or interact with web portals while appearing to be the legitimate employee.

Taken together, these modules create a powerful post-compromise toolkit. The attacker can understand the environment through system profiling, survive restarts through scheduled-task persistence, capture the user's password using PhishLocker, tunnel into internal services using TrafficRedirector, execute commands using the remote shell and directly control the desktop using StreamMaster. This is far more capable than a simple credential stealer and provides many of the ingredients required for lateral movement and eventual ransomware deployment.

The campaign also demonstrates the decreasing usefulness of relying purely on file hashes for malware detection. Expel states that SynkLoader module hashes appear to be unique for each infection, which means traditional indicators based on fixed cryptographic hashes may have limited value. Attackers increasingly modify or rebuild malware for each victim so that every executable has a different hash while retaining essentially identical behaviour. Defenders therefore need behavioural detection capable of recognising suspicious process relationships, persistence activity and network communication rather than depending exclusively on known-malicious file signatures.

For customers, one of the strongest preventive measures is controlling external Microsoft Teams communication. Organisations should review whether users genuinely need to receive unsolicited messages from external tenants and apply Microsoft Teams external-access and federation policies according to business requirements. High-risk groups such as administrators, finance personnel and executives may warrant more restrictive policies. Expel specifically identifies the ability of external organisations to message internal Teams users as an important enabler of this attack technique.

IT support processes should also be clearly defined so employees know how legitimate help-desk personnel will contact them. IT teams should not unexpectedly instruct users through Teams to download MSI packages, install remote-access software or execute PowerShell commands without an established support process. Organisations can introduce verification mechanisms such as support-ticket numbers, known help-desk channels or callbacks through official contact details. The goal is to make it difficult for an attacker to become “IT support” merely by selecting a convincing display name and sending a Teams message.

Application control can significantly reduce the attacker's ability to turn social engineering into code execution. Windows Defender Application Control or similar allow-listing technologies can prevent users from installing unapproved MSI packages, scripts or executables. Standard users should not routinely have permission to install arbitrary software. If an employee can install anything sent by someone claiming to be IT support, the social-engineering barrier is doing far too much of the organisation's security work.

PowerShell monitoring is another important control because SynkLoader uses PowerShell during its deployment and also provides PowerShell-based remote command execution. Script Block Logging, Module Logging and command-line auditing should be enabled and forwarded to central monitoring systems. Defenders should investigate PowerShell started by MSI installers, scripts launched from temporary locations, encoded or hidden PowerShell commands and PowerShell establishing unusual outbound network connections.

Endpoint detection should look for suspicious process chains associated with this campaign. Examples include `msiexec.exe` launching PowerShell, PowerShell extracting Python environments, unusual Python interpreters appearing on machines that do not normally use Python and scheduled tasks launching scripts or binaries from temporary directories. Behavioural relationships between processes often remain consistent even when the attacker modifies filenames and hashes.

The fake lock-screen technique also makes endpoint behaviour monitoring valuable. Security products can potentially detect full-screen applications attempting to imitate system authentication interfaces, particularly when launched from recently downloaded software. More broadly, users should be taught that legitimate Windows authentication after locking normally occurs through the secure desktop and that Ctrl+Alt+Delete is a useful way of reaching the genuine Windows security interface. The awareness message needs to be specific rather than the wonderfully vague corporate advice to “remain vigilant.”

Network segmentation becomes important if SynkLoader successfully compromises an endpoint. Workstations should not automatically have unrestricted access to domain controllers, server management ports, backup infrastructure or every other employee workstation. The TrafficRedirector module can turn an infected device into a proxy, so any resource reachable from that endpoint may effectively become reachable to the attacker. Segmentation and host-based firewall policies can significantly reduce the blast radius.

Organisations should also minimise reliance on IP allow lists for sensitive services. IP restrictions are useful as one layer, but SynkLoader demonstrates how an attacker can route traffic through a legitimate compromised workstation and therefore inherit the expected source address. Sensitive applications should require strong user and device authentication in addition to network-location checks, preferably with Conditional Access or comparable context-aware identity controls.

Multi-factor authentication remains important, although customers need to understand its limits. Capturing the user's Windows password does not automatically defeat properly configured phishing-resistant MFA, but attackers controlling the endpoint may still have access to authenticated sessions and browser tokens. Security keys, passkeys and certificate-based authentication provide substantially stronger protection than authentication methods that can be socially engineered through approval prompts.

Privileged accounts should never be used for ordinary Teams conversations, browsing or general workstation activity. If SynkLoader compromises a standard user's endpoint, the attacker should not automatically obtain credentials capable of administering Active Directory or critical servers. Administrative users should use separate privileged accounts and preferably dedicated privileged-access workstations for sensitive tasks.

Outbound network monitoring is also valuable because the malware needs to communicate with attacker infrastructure. Customers should monitor unusual outbound traffic from Python and PowerShell processes, persistent connections from employee workstations to uncommon Internet destinations and unexpected tunnelling behaviour. Reverse-proxy activity can sometimes be identified through unusual long-lived connections or traffic volumes inconsistent with the workstation's normal profile.

Customers should also watch for newly created scheduled tasks with random names, particularly tasks executing daily at 10 a.m. or at user logon. That schedule is one of the persistence behaviours described in the observed SynkLoader samples. However, defenders should avoid relying on the exact time or task name because attackers can easily change such implementation details once they become publicly documented. Behavioural detection of newly created persistence mechanisms is much more durable.

If SynkLoader infection is suspected, incident response should go beyond deleting the MSI installer. The workstation should be isolated from the network, persistence mechanisms should be identified, captured credentials should be considered compromised and active sessions should be revoked. Because the malware includes password theft, tunnelling, remote command execution and VNC capabilities, defenders should assume the attacker may have interacted manually with the system and accessed additional resources.

The affected user's password should be reset from a known-clean device, and authentication tokens or sessions should be revoked where possible. Security teams should review sign-in logs, Active Directory authentication activity, remote connections and access to file shares or sensitive applications originating from the infected endpoint. If the malware successfully operated as a proxy, subsequent malicious traffic may appear to originate from the legitimate victim machine rather than an external attacker address.

The broader lesson from SynkLoader is that collaboration platforms have become part of the phishing perimeter. Organisations spent years improving email filtering, attachment scanning and malicious-link detection, so attackers logically moved toward channels where employees are less suspicious and defensive controls may be weaker. Expel's Q2 2026 data indicates that Microsoft Teams phishing is already driving a substantial share of targeted endpoint attacks across its monitored environments.

This means Teams, Slack and similar collaboration platforms should receive security controls comparable to email. External senders should be clearly identified, federation policies should follow business necessity, suspicious messages should be reportable to security teams and collaboration telemetry should feed into threat detection. Users also need to understand that the familiar corporate interface does not make every person communicating through it trustworthy.

The campaign provides another useful lesson about legitimate cloud infrastructure. Hosting the malicious MSI on Microsoft Azure can make the download appear more credible and may reduce the effectiveness of simple domain-reputation controls. Attackers increasingly abuse trusted cloud platforms precisely because organisations cannot simply block Microsoft, Google, GitHub or other widely used services. Security controls must therefore evaluate the requested file, user behaviour and execution context rather than trusting a download merely because it originates from a reputable cloud provider.

For customers, the most effective defence is layered: restrict unnecessary external Teams messaging, establish verifiable IT-support procedures, block unapproved MSI execution, monitor PowerShell and scheduled-task creation, deploy behavioural endpoint protection, enforce network segmentation, use phishing-resistant MFA and investigate suspicious remote-access or proxy behaviour. Employees should also know that legitimate IT support should not unexpectedly ask them to install a “cleaner” or other executable from a Teams conversation, and an unexpected Windows lock screen can be checked using Ctrl+Alt+Delete or Alt+Tab.

SynkLoader ultimately demonstrates that phishing is no longer simply about stealing a password through a fake login page. The attackers first establish trust through Microsoft Teams, persuade the employee to install software, profile the corporate environment, establish persistence, imitate the Windows login interface, steal credentials, create a reverse proxy and then provide human operators with interactive control of the endpoint. By the time ransomware eventually appears, if that is indeed the final objective, the important security failures have already happened much earlier in the chain.

The key defensive question should therefore not be merely whether the organisation can detect SynkLoader by name. It should be whether an external Teams user can convincingly impersonate IT support, whether an employee can install an unsolicited MSI, whether PowerShell can quietly stage an unknown Python framework, whether a new scheduled task is noticed, and whether a compromised workstation can proxy an attacker into sensitive internal systems. SynkLoader is new, but virtually every stage it relies upon uses familiar and legitimate technology. That is precisely what makes the campaign dangerous: the attacker is hiding malicious intent inside tools, communication channels and behaviours employees have been trained to trust.

A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]

Source: New SynkLoader malware pushed in Microsoft Teams phishing campaign via Bleeping Computer — published 21 Aug 2026.