New SynkLoader malware is actively being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake Windows 11 lock screen. According to reports from Windows Report and Domainfork, attackers impersonate corporate IT help desks, directing victims to download a malicious MSI installer hosted on Microsoft Azure around July 28, 2026.
The Anatomy of a Multi-Language Threat
SynkLoader represents a complex engineering approach to payload delivery. The malware relies on an unusual combination of Python, PowerShell, C#, and C++. Security researchers have noted that individual modules within the framework utilize as many as three programming languages simultaneously. This polyglot architecture creates significant obstacles for traditional signature-based detection systems, forcing enterprise defenders to look deeper into memory and runtime behavior.
The attack vector begins inside Microsoft Teams. Threat actors reach out directly to corporate employees, posing as internal IT support. They instruct the targeted user to install a supposedly benign utility known as “PowerShell Cleaner.” By hosting this malicious MSI package on Microsoft Azure infrastructure, the attackers exploit implicit trust in trusted cloud content delivery channels.
Modular Attack Components and Payload Flexibility
Once execution succeeds, SynkLoader does not immediately detonate all capabilities. Instead, the framework deploys a modular payload tailored to the specific value of the compromised environment. According to telemetry gathered by Expel, the threat actors execute hands-on-keyboard profiling before selecting which components to activate.
- System Profiler: Gathers hostname, username, privilege levels, running processes, active services, domain information, and Active Directory scale metrics.
- Persistence Module: Establishes a scheduled task with a randomized name designed to trigger upon user login and daily at 10 a.m.
- PhishLocker: Deploys a full-screen borderless application mimicking the Windows 11 lock screen to harvest user credentials.
- TrafficRedirector: Installs a reverse proxy routing traffic through the compromised host to access internal corporate services.
- Interactive Shell: Grants remote PowerShell execution with direct output streaming back to the operator.
- StreamMaster: Implements VNC-style remote desktop capabilities with mouse and keyboard control.
- Module Status Script: Reports active threads and components running within the host environment.
The PhishLocker Illusion and Ransomware Indicators
The PhishLocker component relies on psychological manipulation. By rendering an exact visual replica of the Windows 11 sign-in interface, it tricks victims into inputting their active directory passwords. However, architectural analysis reveals structural flaws in the deception. Because the interface operates as a borderless GUI application rather than a true system process, users can press Alt+Tab to expose background windows or execute a Ctrl+Alt+Delete sequence to test lock screen authenticity.
Expel researcher Marcus Hutchins noted that the malware’s intensive focus on mapping Active Directory topology strongly implies a connection to forthcoming ransomware operations. Understanding network layout and domain size allows threat actors to orchestrate lateral movement efficiently before dropping secondary payloads. Furthermore, when Expel researchers deployed an emulator for the reverse-shell component, the operators terminated the connection immediately upon detecting a sandbox environment.
Enterprise Defense and Verification Strategies
Defending against polyglot malware like SynkLoader requires strict out-of-band verification protocols. Organizations must enforce strict validation rules for any software installation requests arriving via collaboration platforms like Microsoft Teams. When unexpected lock screens appear, administrators recommend utilizing hardware-level interrupt commands such as Ctrl+Alt+Delete to verify system integrity before entering credentials.
