Microsoft Teams Phishing Attacks Deploy SynkLoader to Steal Windows Passwords

Key Takeaways

• A new campaign leverages Microsoft Teams phishing to deploy SynkLoader malware.
• Attackers impersonate IT helpdesk staff to trick employees into installing malicious “fixes.”
• SynkLoader uses a multi-stage, memory-resident toolkit to steal Windows passwords via a fake lock screen, collect system data, and establish persistent access.
• The malware’s components, including a Python-based loader and a traffic redirection module, were first observed around July 28, 2026.
• Organizations should implement strict verification protocols for unexpected support requests and monitor for suspicious activities like unapproved software installations and new scheduled tasks.

Microsoft Teams Phishing Deploys New SynkLoader Malware

Cybersecurity researchers have identified a sophisticated new phishing campaign targeting Microsoft Teams users, which delivers a multi-component malware known as SynkLoader. This attack vector exploits the inherent trust within corporate communication platforms, with threat actors posing as internal IT support to trick employees into installing malicious software.

The campaign employs a classic social engineering tactic: an attacker, masquerading as an IT helpdesk professional, initiates contact with an employee via Teams. The objective is to persuade the target to download and install what appears to be a legitimate, helpful fix or utility. However, this seemingly innocuous request leads to the deployment of SynkLoader, a complex toolkit designed for stealthy system compromise and data exfiltration.

SynkLoader operates with a layered approach, meticulously designed to evade detection. It predominantly executes in memory, minimizing its disk footprint. The malware is capable of gathering extensive details about the victim’s Windows system and establishes a persistent command-and-control channel back to the attackers. This means a simple Teams chat can quickly escalate into a significant corporate network intrusion, enabling reconnaissance and further malicious activities.

Analysts at Expel said in a report that they uncovered the SynkLoader malware during an incident response investigation. Their analysis indicated that the toolkit’s components were newly developed, with compilation and file timestamps suggesting initial creation and distribution around July 28, 2026. Expel highlighted how these Teams helpdesk impersonation campaigns effectively leverage the perceived authority of internal support staff, transforming routine requests into avenues for malware delivery.

Initial Infection Vector and Malware Delivery

The attack begins with an account using a company.onmicrosoft.com address contacting the target, presenting itself as an IT service desk. The attacker then convinces the unsuspecting employee to download an MSI file from Azure Blob Storage. This use of a legitimate cloud service lends an air of credibility to the malicious download.

The downloaded MSI file, disguised as “PowerShell Cleaner,” unpacks a ZIP archive and a PowerShell script into the user’s local application-data folder. This script initiates hidden PowerShell commands before launching a Python-based loader. This multi-stage process is engineered to limit subsequent disk activity, making detection more challenging.

The SynkLoader package includes a small Python environment, various scripts, compiled libraries, and DLL components, all working in concert to execute commands directly in memory. The primary loader cycles through three distinct command-and-control domains, beaconing every 90 to 120 seconds, and is capable of executing additional Python code received from the server.

Beyond initial compromise, SynkLoader performs extensive reconnaissance, collecting critical system information such as the computer name, logged-in username, privilege level, running processes, services, and Active Directory details. This intelligence gathering is crucial for threat actors to assess the value of a compromised machine and plan subsequent moves within the network. The toolkit also establishes persistence by installing a randomly named scheduled task that runs at user logon and at 10 a.m. local time, ensuring the loader is restored after system restarts while avoiding easily identifiable task creation commands.

Fake Lock Screen Steals Passwords

One of SynkLoader’s most dangerous modules is PhishLocker, a component specifically designed to mimic the Windows lock screen. It retrieves the current username and the user’s actual lock-screen background, then displays a full-screen window that perfectly imitates a genuine Windows 11 password prompt. The primary objective of PhishLocker is to harvest the user’s raw Windows password. Crucially, this is not a real lock screen, and the victim can bypass it even if an incorrect password is entered.

The theft of a raw password is far more valuable to attackers than a stolen password hash, particularly in organizations that utilize single sign-on (SSO). A valid password grants wider access to internal services with seemingly legitimate credentials, significantly increasing the potential for lateral movement and deeper network penetration. Complementing this is the TrafficRedirector module, which functions as a reverse proxy through the infected device. This allows attackers to access internal network services or connect to external internet services using the victim’s corporate IP address, thereby reducing suspicious indicators associated with unknown locations.

Expel’s researchers also observed modules for a remote PowerShell shell and a VNC-based remote-control function. During their investigation, the threat actors attempted to execute reconnaissance commands against Expel’s emulated environment, eventually recognizing it was not a live corporate network. Based on their analysis, researchers assessed with low to medium confidence that the SynkLoader toolkit could be associated with a ransomware group or an initial access broker.

What You Should Do

• Verify Unexpected Requests: Employees must independently verify any unexpected support messages or requests through a known, official internal channel (e.g., calling the IT helpdesk directly via a verified number) before installing any software or clicking links, even if the request appears to originate from Microsoft Teams.
• Monitor External Communications: Security teams should review and audit external communications within Microsoft Teams for suspicious activity, especially messages containing download links or requests for software installation.
• Investigate Unapproved Downloads: Implement policies and technical controls to detect and investigate unapproved MSI downloads, particularly those from cloud storage services like Azure Blob Storage, that are not part of sanctioned software deployment.
• Detect New Scheduled Tasks: Monitor for the creation of new scheduled tasks, especially those with random names or unusual execution times, which can indicate persistence mechanisms.
• Watch for In-Memory PowerShell: Deploy endpoint detection and response (EDR) solutions capable of detecting and alerting on suspicious in-memory PowerShell activity, as SynkLoader heavily relies on this technique.
• Block Command-and-Control (C2) Infrastructure: Block or closely inspect network traffic involving the identified command-and-control domains (e.g., neversoftmain[.]net, rootfarmapp[.]net, tripinupdate[.]net, dondermicapp[.]net, aroclenetapp[.]net) and associated IP addresses.
• Preserve Audit Records: Ensure that Microsoft Teams audit logs and other relevant system logs are preserved for an extended period to aid in incident investigation and forensic analysis.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.