SynkLoader Deploying Multi-Stage Modules via Teams Phishing

1. Basic Information

• Article Title: SynkLoader: when you throw in everything but the kitchen sink
• Publisher: Expel
• Publication Date: 2026-08-20
• Update Date: None
• Severity: high
• Original Source: Expel
• Related Sources: New SynkLoader malware pushed in Microsoft Teams phishing campaign
• Related Entities:
  • malware: SynkLoader, PhishLocker, TrafficRedirector
  • groups: None
  • cves: None
  • products: Microsoft Teams, Azure Blob Storage, Windows Task Scheduler, Python

2. Executive Summary

Attackers pose as IT support to run an MSI file, steal credentials using a fake lock screen, and deploy COM tasks, reverse proxies, PowerShell, and VNC.

3. Attack Flow

1. Device Compromise and Lateral Movement via Teams

1. Attackers contact victims on Teams while posing as an IT Service Desk from an external Microsoft 365 tenant.
2. They trick the user into downloading and running a PowershellCleaner MSI from Azure Blob.
3. The MSI extracts cleaner.ps1 and archive6.zip to LocalAppData, and an obfuscated PowerShell script launches a Python loader.
4. It creates a randomly named task via COM. The task runs ss.py with pythonw.exe at logon and daily at 10:00 AM.
5. PhishLocker collects entered passwords using a fake Windows lock screen.
6. TrafficRedirector turns the infected device into a reverse proxy, enabling interactive control via PowerShell shells and VNC.

4. Attacker Positioning and Execution Locations

• Contact via Teams from an external Microsoft 365 tenant
• MSI distribution hosted on Azure Blob
• Selective module delivery from multiple C2 servers
• Use of the compromised device as a relay point between the internal LAN and external allowed services

5. Visibility for Victims and Administrators

Victims

• Asked by IT support to install a PowerShell repair tool.
• Asked to enter a password on a screen that looks like the full-screen Windows lock screen.

Administrators and SOCs

• Observe randomly named scheduled tasks and pythonw.exe running ss.py.
• Observe periodic communication to multiple C2 servers after downloading from external Azure Blob.
• Observe suspicious connections from the victim's IP address to internal and external services.

6. Conditions for Success and Failure

Conditions for Success

• The user runs the MSI file.
• PowerShell, Python, and COM task creation are not blocked.
• The user enters a valid OS password into PhishLocker.
• C2 communication and module delivery succeed.

Conditions for Failure

• Restrict external tenant Teams communication or unknown IT support.
• Block MSI execution, Azure Blob downloads, and obfuscated PowerShell.
• Monitor and block COM Task Scheduler creation.
• Block C2 and reverse proxy communications.

7. What Happens Upon Success

• Theft of Windows credentials
• Persistence and arbitrary PowerShell execution
• Connection to internal services through the compromised device
• Bypassing IP allowlists using the victim device's IP address
• Interactive operations via VNC

8. Observable Logs

Email

• Focused on Teams audit logs rather than email

Proxy / SWG / DNS

• Retrieval of 331.msi from filereserve.blob.core.windows.net
• Communications to tripinupdate.net, dondermicapp.net, aroclenetapp.net, etc.

Endpoint / EDR

• Deployment of PowershellCleaner via msiexec
• cleaner.ps1, archive6.zip, pythonw.exe, ss.py
• Creation of random 12-character tasks via COM
• In-memory PowerShell, fake full-screen lock, VNC

Identity / IdP

• Teams contact from an external tenant
• Authentication to internal and external services using stolen credentials

SaaS / Cloud

• Teams messages and external tenant information
• Downloads from Azure Blob

Network

• C2 communication with 90 to 120-second jitter
• Internal-bound connections and outward relay via TrafficRedirector

9. Attack Success Assessment

• Attack Attempt Observed (Success Unconfirmed): External Teams contact or MSI URL received only, with no execution.
• User Action Confirmed: MSI download or execution confirmed.
• Initial Execution Confirmed: cleaner.ps1, Python loader, and scheduled task generation confirmed.
• Malware Execution or Authentication Success Confirmed: SynkLoader C2 communication, PhishLocker input, and additional module execution confirmed.
• Post-Compromise Activity Confirmed: TrafficRedirector, PowerShell shell, VNC, and internal service connections confirmed.

10. Investigation Playbook

Trigger

• IT support impersonation from external Teams
• Random-name COM task and pythonw.exe
• Communication to known C2 servers

Initial Verification

• Preserve Teams conversation, sending tenant, and Blob URL
• Determine MSI execution time and initial EDR event

Endpoint

• Collect PowershellCleaner and randomly placed files from LocalAppData
• Check task XML, Python environment, memory, and credential input traces

Authentication and Cloud

• Change user password and revoke all sessions
• Cross-check internal and external authentication from the victim IP address

Subsequent Operations

• Investigate internal connections, PowerShell, and VNC after the reverse proxy
• Search for other users who received the same external tenant and URL

Containment

• Isolate device, stop tasks, and block C2
• Rotate credentials and block the external Teams sender

Assessment Categories

• Contact only
• MSI execution
• Loader persistence
• Credential theft
• Interactive control and lateral movement

11. Defense and Detection Ideas

Single Event

• External Teams user sends an MSI URL
• Random-name task via COM Task Scheduler
• Execution of ss.py via pythonw.exe

Timeline Correlation

• Teams contact -> Azure Blob MSI -> PowerShell -> Python -> Task creation
• PhishLocker -> Internal authentication from victim IP -> Reverse proxy communication

Hunting Perspective

• Brought-in Python and ss.py under LocalAppData
• Task Scheduler COM usage without schtasks.exe
• Known C2s and random task names

Log Gaps

• Teams message body and external tenant information
• Task creation via COM/RPC
• Service-side audits that blindly trust the victim IP address

Priority Countermeasures

• Control external Teams communications
• Control MSI and script execution
• Implement strong authentication that does not rely solely on IP allowlists

12. Facts / Inference / Hypothesis

Facts

• Expel discovered SynkLoader when EDR detected a scheduled task in a customer environment on August 18, 2026.
• Attackers posed as IT Service Desk on Teams and tricked users into running an MSI on Azure Blob.
• Persistence uses Task Scheduler COM instead of schtasks.exe.
• TrafficRedirector can relay traffic from the compromised device to the internal LAN and external services.

Inference

• The attackers intend to bypass geographic and IP anomaly detection by combining stolen passwords with the victim device's IP address.

Hypothesis

• Based on the discovery of Active Directory scope in Expel's virtual environment, the ultimate objective may be ransomware deployment or initial access sales, but this is unconfirmed.

13. MITRE ATT&CK Mapping

• T1566.002 Phishing: Spearphishing Link (Confidence: high)
• T1218.007 System Binary Proxy Execution: Msiexec (Confidence: high)
• T1059.001 PowerShell (Confidence: high)
• T1053.005 Scheduled Task/Job: Scheduled Task (Confidence: high)
• T1056.002 Input Capture: GUI Input Capture (Confidence: high)
• T1090.001 Proxy: Internal Proxy (Confidence: high)
• T1021 Remote Services (Confidence: medium)

14. Unknowns and Additional Investigation

• Attacker attribution
• Whether passwords were actually entered in real victim environments
• Ultimate objectives and subsequent payloads

15. Impact on SOCs

Organizations that allow external Teams collaboration and Azure Blob access are vulnerable to this exact lure. IP allowlists that trust the victim device's IP address do not provide effective protection, requiring a combined approach of device state, MFA, and behavior monitoring.

16. Summary by Target Audience

For SOCs

Monitor the timeline of Teams -> Blob MSI -> PowerShell/Python -> COM task -> reverse proxy.

For Administrators

Control external Teams, MSIs, brought-in Python, and Task Scheduler COM. Eliminate authentication methods that rely solely on IP allowlists.

For Users

If someone claiming to be IT support asks you to run a repair tool via Teams, verify through a separate, trusted internal channel.