There's a new malware campaign devs and IT teams should know about — SynkLoader. It doesn't rely on a software vulnerability or a phishing email. It relies on something most of us implicitly trust: a Microsoft Teams message from "IT support."
How the attack works
Attackers contact employees via Teams chat (or a vishing call), impersonating internal IT or helpdesk staff. They claim there's a pending update or performance fix and convince the victim to download a fake "PowerShell Cleaner" MSI installer — hosted on legitimate Microsoft Azure Blob Storage, which lets it slip past most secure web gateways and URL reputation checks.
Once executed, the installer drops a PowerShell script (cleaner.ps1) and a ZIP archive containing a stripped-down Python environment, precompiled libraries, and DLLs disguised as legitimate Microsoft runtime files. The loader runs largely in memory, using an encrypted C2 channel (researchers observed a modified ChaCha20 implementation), which makes it harder for EDR tools to catch using file-based signatures alone.
PhishLocker: the fake lock screen
The most dangerous module is PhishLocker — a fake Windows 11 lock screen that performs zero real authentication. It accepts any input, captures the raw plaintext password, and sends it to the attacker. Because it grabs the raw password instead of a hash, it bypasses typical hash-based credential theft detection (like Mimikatz rules).
Beyond PhishLocker, SynkLoader can deploy a remote access trojan, a VNC module for full desktop control, and a network tunneling tool capable of bypassing IP allow-list protections.
Why this matters for engineering and IT teams
There's no CVE here. This is pure social engineering exploiting trust in an internal communication channel most security training doesn't cover.
In the full write-up, I cover:
- The complete attack chain, step by step
- Indicators of compromise (IOCs) SOC teams should hunt for
- Real PowerShell detection commands
- Prevention strategies for engineering orgs and IT teams
🔗 Full breakdown: https://www.xpert4cyber.com/2026/08/synkloader-malware-microsoft-teams-it-support.html
If your team uses Microsoft Teams for internal support (most do), this is worth bookmarking.
Top comments (0)