Expel’s analysis found compile dates and file timestamps indicating SynkLoader was first compiled and distributed around July 28, 2026.
Delivery: Microsoft Teams phishing and an Azure-hosted "PowerShell Cleaner"
Attackers are distributing a previously unknown malware family, dubbed SynkLoader, inside Microsoft Teams phishing messages that impersonate a target company’s IT help desk. The campaigns direct victims to download a supposedly legitimate executable — a “PowerShell Cleaner” .MSI — hosted in Microsoft Azure, a distribution choice that the researchers say makes the download appear more trustworthy.
Microsoft has highlighted the IT-help-desk impersonation tactic earlier this year as increasingly common in multi-stage attacks; Expel’s researcher Marcus Hutchins traced the SynkLoader activity back to that same social-engineering pattern.
Module architecture: a mixed-language, plug-in toolset
Expel cataloged a suite of SynkLoader modules after deploying a honeypot that pinged the attacker’s command-and-control infrastructure while posing as a legitimate victim. The components observed include:
- System Profiler — collects hostname, username, privilege level, running processes, services, domain details, and number of computers in Active Directory.
- Persistence Module — creates a randomly named scheduled task that launches SynkLoader at user logon and daily at 10 a.m.
- PhishLocker — displays a fake Windows lock screen to capture the user’s login password.
- TrafficRedirector — creates a reverse proxy enabling attackers to reach internal network services or route internet traffic through the infected host.
- Interactive Shell (RAT) — lets attackers remotely execute PowerShell commands and receive output.
- StreamMaster (VNC) — streams the victim’s desktop and permits remote mouse and keyboard control of the active session.
- Module Status Script — reports which malware modules and associated threads are currently running.
Expel named the family SynkLoader because of its unusual combination of Python, PowerShell, C#, and C++, with some modules blending up to three languages in a single component.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coveragePhishLocker: convincing UI, simple reveal
The most notable module is PhishLocker, which displays a convincing fake Windows lock screen to capture Windows account passwords. By obtaining local account credentials and pairing them with the tunneling capability of TrafficRedirector, attackers can move from an infected endpoint into corporate environments and bypass IP allow-list restrictions.
Expel cautioned that the fake lock screen is only a full-screen application: Alt+Tab will expose active windows on top of it because it is just a “full-screen borderless GUI application.” The researchers also recommend trying Ctrl+Alt+Delete or Alt+Tab when confronted with an unexpected lock screen to determine authenticity.
Installer contents, operational behavior, and forensic limits
The SynkLoader installer extracts a PowerShell script named cleaner.ps1 and a ZIP archive containing a Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs. The malware’s deployment is tailored: attackers select which modules to enable based on the breached environment profile and operational targets.
During the honeypot interaction, Expel’s team wrote an emulator for the reverse shell and determined the intrusion was a hands-on-keyboard operation. “We did end up writing an emulator for the reverse shell module, just to confirm it was actually a hands-on-keyboard attack,” Hutchins said. “The threat actor attempted to run several profiling commands before realizing they were not in a real environment and disconnecting.”
Expel provided indicators of compromise (IoCs) for the observed activity but warned that SynkLoader module hashes are unique for each infection and therefore not highly useful for defenders looking to match static signatures.
The Blue Report 2026, which measures defenses technique by technique across 338 million simulations run in customer production environments, notes that “Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.”
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: watch for scheduled tasks with random names, unexpected reverse-proxy connections, and Active Directory profiling activity; consider monitoring for rapid creation of local persistence and anomalous desktop-streaming sessions.
- Affected enterprises and procurement leaders: scrutinize processes that allow Azure-hosted binaries or unsigned MSI distribution channels to appear as legitimate maintenance tools; require independent verification of IT requests that prompt software installation.
- End users and help desks: verify unsolicited IT requests independently and avoid installing unsolicited .MSI files; when faced with an unexpected lock screen, try Ctrl+Alt+Delete or Alt+Tab to test whether the screen is a genuine Windows lock screen or a “full-screen borderless GUI application.”
SynkLoader combines straightforward social engineering with a modular, mixed-language toolkit and a focus on credential theft and internal tunneling. Its apparent debut in late July 2026, its use of Azure-hosted installers, and the PhishLocker module’s aim at Windows credentials make it a timely reminder that initial access controls can be bypassed by credential capture — and that detecting what happens after that capture is the harder problem. For a technical readout and IoCs, see the original reporting.
