SynkLoader Malware Spreads Via Fake Teams IT Support Chats

Security researchers have identified a previously unknown malware family called SynkLoader, distributed via Microsoft Teams phishing campaigns impersonating corporate IT help desks. Expel researcher Marcus Hutchins uncovered the loader while investigating an incident on a client network, after an endpoint tool flagged a suspicious task.

Compile dates and file timestamps on the malware's components indicate that the threat actors first built and deployed SynkLoader around July 28, 2026. Analysts found no prior public references to the loader or any of its individual modules, suggesting the toolkit remains largely undocumented and new.

The attack begins when a threat actor contacts an employee through Microsoft Teams, posing as a member of the company's internal IT service desk. The attacker uses a Microsoft 365 default email domain to appear legitimate, then persuades the target to download an executable file. That file presents itself as a "PowerShell Cleaner" utility and is hosted on a genuine Microsoft Azure file storage endpoint.

Hosting the file on genuine Azure infrastructure helps the malicious download evade suspicion from both users and automated security scanning tools. Once the victim runs the MSI installer, it silently extracts a PowerShell script and a compressed archive onto the machine. That archive contains a complete Python framework that bundles a malicious script, precompiled libraries, and several DLL files disguised as Microsoft runtime components.

Researchers named the malware SynkLoader because of its "everything but the kitchen sink" design, which chains together Python, PowerShell, C#, and C++. Some individual modules combine up to three separate programming languages in a single operation, adding further complexity for defenders. This layered approach appears intended to frustrate detection tools, since many security products focus scrutiny on specific languages rather than cross-language chains.

The core loader communicates with command-and-control servers using a modified ChaCha20 encryption scheme that alters the standard default key values. It checks in with its controllers at randomized intervals ranging from 90 to 120 seconds per cycle. Once connected to that infrastructure, the loader can receive and immediately execute arbitrary Python code sent directly from the attacker.

Expel set up a honeypot system that mimicked a large corporate network, then fed the attackers falsified reconnaissance data to observe their next move. That approach revealed several distinct capabilities built into the SynkLoader framework, all of which are summarized in the list below:

• System Profiler collects the hostname, username, privilege level, running processes, and the size of the connected Active Directory environment.
• Persistence Module installs a randomly named scheduled task that relaunches the malware at every user logon and daily at 10 a.m.
• PhishLocker displays a convincing fake Windows lock screen to capture the victim's login password directly.
• TrafficRedirector creates a reverse proxy that lets attackers reach internal systems or route traffic through the infected machine.
• Interactive Shell lets attackers remotely execute PowerShell commands and retrieve the output in real time.
• StreamMaster streams the victim's screen using a VNC-style protocol and enables remote control of the active session.

A Fake Lock Screen Designed to Steal Passwords

The PhishLocker module stands out as the most notable component, recreating the Windows 11 lock screen inside a full-screen application. The fake screen never actually verifies the entered password against Windows, so any input the victim types will unlock the interface. Because it runs as an ordinary borderless window rather than a genuine system lock, pressing Alt+Tab exposes the windows running underneath.

Expel noted that the technique gives attackers the victim's raw password rather than a hash, which proves especially valuable against single sign-on environments. Hutchins explained that stolen credentials, combined with the TrafficRedirector module, would let attackers reach corporate systems while bypassing IP-based access restrictions entirely.

Expel ultimately built a working emulator for the malware's reverse shell module to confirm a real person was directing the intrusion. "We did end up writing an emulator for the reverse shell module, just to confirm it was actually a hands-on-keyboard attack," Hutchins wrote. The operator reportedly ran several profiling commands before apparently recognizing the fake environment, then quickly disconnected from the honeypot entirely.

The malware's focus on counting Active Directory systems, a metric used to gauge how disruptive an intrusion could become, led Expel to a working theory. Researchers assessed with low to medium confidence that the toolkit likely belongs to a ransomware group or an access broker.

Such brokers typically sell established network footholds directly to ransomware operators, who then carry out the resulting extortion attacks against victims. Expel published indicators of compromise for the observed intrusion but cautioned that module hashes vary between infections, limiting their usefulness for broader detection efforts.

The SynkLoader campaign reflects a broader pattern that Microsoft highlighted earlier in 2026, warning that attackers increasingly abuse external Teams chats. Microsoft described a nine-stage attack chain that typically begins with a threat actor contacting an employee and claiming an urgent account issue. The attacker then convinces the target to start a remote support session, often through Quick Assist, granting direct device control.

From there, intruders conduct reconnaissance using Command Prompt and PowerShell before deploying payloads via DLL side-loading through trusted, signed applications. Persistence is typically established through Windows Registry modifications, after which attackers abuse Windows Remote Management to move laterally across the network.

"Threat actors are increasingly abusing external Microsoft Teams collaboration to impersonate IT or helpdesk personnel and convince users to grant remote assistance access," Microsoft said. The company noted that this activity often blends into routine IT support work, making malicious sessions difficult for defenders to distinguish from legitimate ones. Microsoft recommended several practical defenses that organizations can adopt, listed below, to reduce their overall exposure to this recurring style of attack:

• Treat all external Teams contacts as untrusted by default, particularly messages claiming to be from IT support.
• Restrict or closely monitor the use of remote assistance tools such as Quick Assist across the organization.
• Limit Windows Remote Management usage to controlled systems and closely audited administrative accounts only.
• Pay close attention to Teams security warnings that flag messages originating from outside the organization.

Both Expel and Microsoft emphasize that employees should always independently verify any unsolicited IT support request before granting remote access. Users who encounter an unexpected lock screen should try pressing Ctrl+Alt+Delete or Alt+Tab to confirm whether it is truly genuine. As threat actors continue to refine social engineering techniques targeting trusted collaboration platforms, organizations are advised to strengthen employee training and remote access controls.