SynkLoader: The Malware Using Microsoft Teams to Steal Credentials and Control PCs

A Fake IT Tool Distributed Through Teams

A new malware family called SynkLoader was disclosed on August 21, 2026, after being observed in phishing campaigns conducted through Microsoft Teams. The operators pose as IT staff and persuade victims to install a purported maintenance tool called “PowerShell Cleaner.”

The software is distributed as an MSI file hosted on Microsoft Azure. Using a recognizable cloud infrastructure may make the download appear less suspicious, but it does not indicate Microsoft’s involvement in the campaign.

Compilation dates and the analyzed timestamps place SynkLoader’s initial build and distribution around July 28, 2026. The malware was therefore active several weeks before it was publicly disclosed.

The attack exploits the trust users place in internal messages and supposed help-desk interventions. A request received through Teams may appear more credible than a typical email, particularly when the attacker knows the organization’s name or uses language consistent with that of the IT department.

An MSI Installer Hiding Multiple Components

The installer extracts a PowerShell script named cleaner.ps1 and a ZIP archive. The archive contains the Python framework, a malicious Python script, precompiled libraries, and fake DLLs designed to imitate Microsoft runtimes.

SynkLoader combines components written in Python, PowerShell, C#, and C++. A single module may use up to three of these languages, increasing the complexity of analysis and making defenses based on monitoring only one file type less effective.

The analysis was conducted after researchers set up a honeypot capable of contacting the command-and-control server, or C2, while simulating the behavior of a real victim. The operator responded with reconnaissance activity and terminated the connection after realizing the environment was not genuine.

The identified modules do more than simply collect data. Together, they provide the attacker with environmental visibility, persistence, interactive access, and remote control of the Windows session.

From Reconnaissance to Remote Control

The System Profiler module gathers information about the computer and network. The collected data includes the hostname, username, privilege level, running processes, services, domain membership, and the number of computers present in Active Directory.

The latter detail is particularly useful for estimating the size of the compromised organization. The presence of reconnaissance specifically targeting the Active Directory environment is also one reason Marcus Hutchins of Expel considers SynkLoader a plausible tool for ransomware operations.

The Persistence Module creates a scheduled task with a random name. The task runs when the user logs in and every day at 10:00, with the goal of restarting SynkLoader after a reboot or disconnection.

The most dangerous module for credential theft is PhishLocker. It displays a fake Windows screen presented as a Windows 11 lock screen and requests the account password. It is not a genuine system lock, however: the screen is a borderless graphical application.

This characteristic can expose its true nature. Pressing Alt+Tab may display the active windows and reveal that the supposed lock screen is actually a program. Ctrl+Alt+Delete can also help verify whether the screen is authentic.

SynkLoader also includes TrafficRedirector, which creates a reverse proxy. The attacker can use it to reach internal services through the infected computer or route Internet traffic through the compromised workstation.

Stolen credentials and tunneling can therefore work together. An attacker could use access from the infected machine to reach corporate resources and bypass restrictions based on allowlisted IP addresses.

The Interactive Shell module, described as a RAT, enables the execution of PowerShell commands and the retrieval of their results. StreamMaster, which is VNC-based, streams the victim’s desktop and allows the attacker to control the mouse and keyboard in the active session.

Finally, the Module Status Script reports which modules and threads are operational. This allows the attacker to monitor the state of the compromise and decide which capabilities to activate.

Why the Threat Matters Operationally

SynkLoader combines capabilities that would normally appear at different stages of an intrusion: profiling, credential theft, persistence, remote access, tunneling, and session control.

The risk is not limited to the theft of a Windows password. A valid credential can facilitate lateral movement, access to internal services, and the collection of information about the organization. The ability to inspect Active Directory also gives operators useful information for identifying high-value targets.

During testing, the operator executed several reconnaissance commands before terminating the connection. A reverse-shell module emulator developed by the researchers confirmed that access was controlled manually rather than solely through an automated sequence.

No formal severity classification or CVSS score has been disclosed. However, the threat presents a significant operational risk given the capabilities available after infection.

The indicators published for the observed attack should be used with caution. Module hashes change between infections and may therefore have limited value as a standalone detection method.

How to Defend Against It and What to Monitor

Users should verify every request that appears to come from the help desk through an independent channel. A message received through Teams should not automatically be considered trustworthy, particularly when it asks the user to install an MSI or enter a password.

Unexpected or unsolicited MSI files should not be executed. Organizations can also restrict software installation to authorized accounts and inspect packages before deployment.

If an unexpected lock screen appears, Ctrl+Alt+Delete and Alt+Tab can provide an initial check. If other windows appear or the behavior does not match normal Windows behavior, the computer should be isolated and reported to the security team.

From a technical perspective, defensive teams should look for:

• scheduled tasks with random names;
• unusual PowerShell executions and the presence of cleaner.ps1;
• ZIP archives containing Python runtimes and unusual DLLs;
• connections to C2 servers;
• reverse proxies and unexpected traffic originating from the workstation;
• abnormal Active Directory queries;
• the use of VNC or unauthorized remote-control tools.

Detection should not rely solely on hashes. A more effective approach combines process telemetry, PowerShell events, scheduled tasks, authentication data, network connections, and account behavior.

No specific vulnerable software versions have been identified because SynkLoader does not exploit a product vulnerability. Instead, it relies on social engineering, legitimate Windows components, and cloud services to achieve initial execution.