New SynkLoader Malware Distributed Through Microsoft Teams Phishing Campaigns

Severity
Medium

Detail

A previously unknown malware family called SynkLoader is being distributed through Microsoft Teams phishing campaigns to steal Windows credentials using a fake lock screen. The attackers impersonate the target organization’s IT help desk, a tactic that has been increasingly observed in multi-stage attacks. Victims are directed to install a fake “PowerShell Cleaner” MSI file hosted on Microsoft Azure, making the download appear legitimate.

According to Expel security researcher Marcus Hutchins, analysis of the malware showed compile dates and file timestamps indicating that SynkLoader was first compiled and distributed around July 28, 2026. The installer extracts a PowerShell script named cleaner.ps1 and a ZIP archive containing a Python framework, malicious Python code, precompiled Python libraries, and several fake Microsoft runtime DLLs. Attackers select which modules to deploy based on the compromised environment and operational objectives. SynkLoader received its name because it combines Python, PowerShell, C#, and C++, with some modules incorporating up to three programming languages.

How?

The attack begins with Microsoft Teams phishing in which the attacker impersonates the target company’s IT help desk. The victim is instructed to download and install a fake “PowerShell Cleaner” MSI hosted on Microsoft Azure. The installer extracts cleaner.ps1 and a ZIP archive containing the Python framework and malicious components. After deployment, the attackers can selectively activate SynkLoader modules based on the compromised environment.

Expel identified several modules after establishing a honeypot that communicated with the attacker’s C2 while appearing to be a legitimate victim:

• System Profiler — Collects the hostname, username, privilege level, running processes, services, domain information, and the number of computers in Active Directory.
• Persistence Module — Creates a randomly named scheduled task that launches SynkLoader at user logon and daily at 10 a.m.
• PhishLocker — Displays a fake Windows lock screen designed to capture the victim’s Windows password.
• TrafficRedirector — Creates a reverse proxy that allows attackers to access internal network services or route internet traffic through the infected computer.
• Interactive Shell (RAT) — Enables remote execution of PowerShell commands and returns their output.
• StreamMaster (VNC) — Streams the victim’s desktop and provides remote mouse and keyboard control of the active session.
• Module Status Script — Reports the malware modules and associated threads that are currently running.

Impact

The PhishLocker module attempts to obtain the victim’s Windows account password through a convincing fake Windows lock screen. Once obtained, the password can potentially be used together with the tunneling capability to access corporate environments from the compromised device and bypass IP allow-list restrictions.

SynkLoader also provides attackers with system profiling, persistence, remote command execution, reverse proxy, and remote desktop capabilities. Expel observed the threat actor attempting several profiling commands before realizing that the environment was not a genuine victim and disconnecting. Based on SynkLoader’s focus on determining the size of Active Directory environments, the malware is believed to potentially be used in ransomware operations.

Recommendation

• Independently verify unexpected IT requests before following instructions or installing software.
• Avoid installing unsolicited MSI files.
• If an unexpected lock screen appears, use Ctrl+Alt+Delete or Alt+Tab to help determine whether the lock screen is genuine.

Conclusion

SynkLoader is a newly identified malware family distributed through Microsoft Teams phishing campaigns using IT help desk impersonation and a fake PowerShell Cleaner MSI hosted on Microsoft Azure. The malware combines Python, PowerShell, C#, and C++ components and provides multiple capabilities, including credential theft through a fake Windows lock screen, persistence, system profiling, reverse proxy functionality, PowerShell command execution, and remote desktop access.

The PhishLocker component is particularly significant because stolen Windows credentials could be combined with the tunneling capability to access corporate environments from the compromised device. Expel’s observations also suggest that the malware may be associated with ransomware operations.

Source

https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/
https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/