SynkLoader Microsoft Teams phishing attacks are distributing a previously unknown malware family that combines a convincing fake Windows lock screen with a full remote-access toolkit, according to analysis by Expel’s security researcher Marcus Hutchins. The malware was first compiled and distributed around 28 July 2026, and its architecture is unlike most commodity loaders: it blends Python, PowerShell, C#, and C++, sometimes three languages within a single module.
The campaign opens with an attacker impersonating the target company’s IT help desk over Microsoft Teams, a tactic Microsoft flagged earlier this year as increasingly common in multi-stage attacks. Victims are directed to download a fake “PowerShell Cleaner” executable packaged as an MSI file and hosted on Microsoft Azure, giving the download an air of legitimacy it does not deserve.
How SynkLoader Microsoft Teams Phishing Installs Itself
The MSI does more than drop a few files. According to CyberPress, the installer runs a PowerShell script entirely in memory, using nested Invoke-Expression and ScriptBlock::Create calls to decrypt an AES-CBC payload before deploying a full embedded Python environment to %AppData%. Running the decryption stage in memory is a deliberate choice: it leaves no plaintext payload on disk for endpoint tools to scan at rest.
The installer also extracts a ZIP archive containing the Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs. Separately, daily.dev reports that SynkLoader uses a stripped-down Python environment and persists via COM hijacking to evade endpoint detection and response (EDR) tools, a technique that abuses legitimate Windows component registration rather than the more easily flagged scheduled-task route. A scheduled task is also created (launching SynkLoader at user logon and daily at 10am) giving the attackers two separate persistence footholds.
Expel identified the full module set by setting up a honeypot that pinged the attacker’s command-and-control (C2) server while posing as a genuine victim. The modules collected break down as follows: a System Profiler gathering hostname, username, privilege level, running processes, services, domain details, and Active Directory computer count; a TrafficRedirector building a reverse proxy into the internal network; an Interactive Shell for remote PowerShell execution; and StreamMaster, a VNC-style component that streams the victim’s desktop and accepts mouse and keyboard input.
PhishLocker: The Fake Lock Screen at the Heart of the Attack
The most consequential component is PhishLocker, which displays a convincing fake Windows lock screen to capture the user’s login password. Expel notes that the lock screen is, in reality, a full-screen borderless GUI application sitting on top of active windows, pressing Alt+Tab exposes everything underneath. The password, once harvested, pairs with the TrafficRedirector module to let attackers reach corporate resources from the infected machine while bypassing IP allow-list controls.
Hutchins assessed, with low-to-medium confidence, that SynkLoader is tied to a ransomware group or an initial access broker (IAB). The reasoning, per CyberPress, centres on SynkLoader’s consistent focus on counting Active Directory-joined systems, a metric typically used to size potential ransom demands before an operator decides whether a target is worth encrypting.
To test the hands-on-keyboard nature of the operation, Expel wrote an emulator for the reverse shell module. “The threat actor attempted to run several profiling commands before realising they were not in a real environment and disconnecting,” Hutchins said. The exercise confirmed that a human operator, not an automated script, was on the other end of the C2 connection.
Expel published indicators of compromise (IoCs) for the observed attack, though it cautioned that SynkLoader module hashes are unique per infection and therefore of limited use for defenders scanning at scale. The practical guidance is more behavioural: verify IT requests through an independent channel, refuse unsolicited MSI files, and (if an unexpected lock screen appears) press Ctrl+Alt+Delete or Alt+Tab to check whether it is genuine before entering any credentials.
