SynkLoader malware hits Microsoft Teams via fake IT-helpdesk phishing
Microsoft Teams users are being targeted with fake IT-helpdesk messages that install SynkLoader, a novel multi-language malware which harvests Windows account passwords through a convincing fake lock screen.
Source: BleepingComputer · August 22, 2026 at 1:08 AM · AI-assisted report
Single-source
KUALA LUMPUR, 22 AUGUST 2026 —
Listen to this article
DomainFork Audio · read aloud
Microsoft Teams users are being targeted with fake IT-helpdesk messages that install SynkLoader, a novel multi-language malware which harvests Windows account passwords through a convincing fake lock screen.
Market Impact
Security firm Expel said the campaign impersonates a company’s IT support and directs the victim to download a fraudulent “PowerShell Cleaner” MSI package hosted in Microsoft Azure. The installer deploys a PowerShell script and a ZIP archive containing Python, C#, and C++ components, including the PhishLocker module that overlays a fake Windows lock screen to capture the user’s password.
According to Expel researcher Marcus Hutchins, compile dates and file timestamps indicate the malware was first compiled and distributed around July 28, 2026. Analysis shows the attackers profile the breached environment and select which SynkLoader modules to deploy, with the malware switching between Python, PowerShell, C#, and C++ within the same module.
The fake lock screen is designed to look authentic, but pressing Alt+Tab reveals it is a full-screen GUI application that can be bypassed. Hutchins said the malware’s focus on measuring Active Directory environment size points to use in ransomware operations. “We wrote an emulator for the reverse-shell module to confirm it was a hands-on-keyboard attack,” he said. “The threat actor ran profiling commands, realized they were in a sandbox, and disconnected.”
Expel released indicators of compromise for the observed attack, adding that each SynkLoader module hash is unique, limiting the value of signature-based detection for defenders. The vendor recommends verifying unsolicited IT requests and avoiding MSI files received out of band, as well as using Ctrl+Alt+Delete to check the authenticity of any unexpected lock screen.
The Blue Report 2026, based on 338 simulations run in customer production environments, shows that once attackers obtain valid credentials, signature-based prevention effectiveness drops to about 50%, underscoring the need for multi-layer defenses against novel phishing lures.
Related: Microsoft