New SynkLoader Malware Pushed in Microsoft Teams Phishing Campaign

A New Loader Targeting the Help Desk Attack Surface

Incident responders at Expel have published analysis of SynkLoader, a newly discovered multi-language malware loader first identified during an August 2026 engagement. First compiled approximately July 28, 2026, the malware had no prior public references at the time of discovery — a zero-day malware family, in practical terms.

SynkLoader is delivered via Microsoft Teams-based vishing (voice phishing), continuing a trend that has seen Teams-based malicious call attempts surge roughly 80% year-to-date in 2026. It combines credential theft, network tunneling, and persistent remote access in a single infection chain.

The Attack Chain

Stage 1: Teams Vishing

Attackers impersonate IT helpdesk personnel via Microsoft Teams messages or calls. The target is told their device needs to be cleaned with a PowerShell maintenance tool. The victim is directed to download what appears to be a legitimate "PowerShell Cleaner" utility — an MSI installer hosted on Microsoft Azure infrastructure, lending the download apparent legitimacy through a trusted domain.

Stage 2: MSI Execution

The MSI drops several components to disk:

SynkLoader Dropped Components
├── cleaner.ps1              — PowerShell first-stage loader
├── python-runtime.zip       — Bundled Python interpreter
├── payload.py               — Malicious Python script (core logic)
├── precompiled-libs/        — Python dependency .pyc files
└── fake-runtime-dlls/       — Counterfeit Microsoft runtime DLLs
                               (for DLL sideloading / AV evasion)

The PowerShell script unpacks and executes the Python payload, which orchestrates the subsequent stages.

Stage 3: Module Deployment

SynkLoader is modular — three primary capability modules are deployed:

Persistence is established via scheduled tasks, ensuring the loader survives reboots and user logoffs.

Technical Capabilities

Credential Theft via Fake Lock Screen

The most immediately damaging module presents a convincing fake Windows lock screen after execution. When the victim enters their credentials to "unlock" the machine, the credentials are captured and exfiltrated to the attacker's command-and-control infrastructure. This technique has become increasingly common because it harvests credentials that may work across multiple internal systems.

Network Tunneling

The tunneling module establishes a reverse proxy from the infected host back to attacker-controlled infrastructure. This allows the attacker to use the victim machine as a pivot point to reach:

• Internal network resources not directly internet-accessible
• Other endpoints on the corporate LAN
• Cloud resources accessible from the victim's network identity

This capability is a hallmark of initial access brokers and ransomware pre-positioning activity.

Multi-Language Design

SynkLoader's use of Python, C#, C++, and PowerShell across different modules is deliberate:

Language    │  Module              │  Evasion Benefit
────────────┼──────────────────────┼────────────────────────
PowerShell  │  First-stage loader  │  Living-off-the-land
Python      │  Core orchestration  │  Interpreted — no PE
C++ DLLs    │  Fake runtimes       │  Code signing abuse
C#          │  Remote access       │  .NET — hard to YARA

Critically, each module's file hashes are unique per infection. Static IOC matching on hashes is ineffective.

Campaign Context: Teams Vishing Is Accelerating

SynkLoader is the latest entry in a campaign pattern that has shown alarming growth:

The Microsoft Teams vector is effective for several reasons:

1. Implicit trust — Teams messages appear to come from within the organization's environment
2. High click rates — employees are conditioned to respond to IT helpdesk communications
3. Azure hosting — malware served from *.blob.core.windows.net or similar trusted domains bypasses many URL filters
4. No email gateway — Teams communications often bypass email-focused security controls

Detection

Behavioral Indicators

High-confidence indicators:
• MSI execution followed by Python interpreter unpack
• Scheduled task creation with random name referencing Python
• Outbound reverse proxy connection (non-standard port)
• Lock screen replacement / credential prompt outside expected context
• DLL load of non-Microsoft DLL named to mimic VC++ redistributables
 
Medium-confidence indicators:
• Teams call from external tenant followed by MSI download within minutes
• Azure Blob Storage MSI download outside approved software catalog
• New scheduled task running from %APPDATA% or %TEMP%

Endpoint Detection (YARA Concept)

rule SynkLoader_Python_Dropper {
    meta:
        description = "SynkLoader Python payload staging"
        date = "2026-08"
    strings:
        $ps_invoke = "Invoke-Expression" nocase
        $py_zip = "python-runtime.zip" nocase
        $cleaner = "cleaner.ps1" nocase
    condition:
        2 of them
}

SIEM Detection

index=endpoint sourcetype=sysmon EventCode=1
| where process_name="msiexec.exe"
  AND parent_image="*teams*"
| join type=inner [
    search index=endpoint sourcetype=sysmon EventCode=11
    | where file_path MATCHES ".*python.*zip.*|.*cleaner.*ps1.*"
  ]
| stats count by host, user, CommandLine

Response Recommendations

Immediate (Upon Suspected SynkLoader Infection)

1. Isolate the host from the network immediately — the tunneling module may already be providing attacker access
2. Reset credentials for the affected user across all systems — harvested via fake lock screen
3. Audit scheduled tasks on the infected host for persistence mechanisms
4. Review Teams call logs for external caller impersonating IT helpdesk
5. Check for lateral movement — review authentication events from the infected host to other internal systems in the 24-48 hours post-infection

Preventive

• Enable Microsoft Teams external access controls — restrict or block calls/messages from external tenants
• Add IT helpdesk verification procedures — employees should call back IT on a known internal number before installing anything
• Block MSI downloads from Azure Blob storage domains outside your software catalog
• Deploy Application Allowlisting — prevent execution of uncatalogued Python environments

Sources

• BleepingComputer — New SynkLoader malware pushed in Microsoft Teams phishing campaign
• Expel — SynkLoader: when you throw in everything but the kitchen sink
• The Hacker News — SynkLoader Malware Targeting Enterprise via Teams Phishing

Related Reading

• Apollo Discloses Data Breach from Ongoing Wave of Attacks Hitting Financial Sector
• ZeroDayRAT Mobile Spyware Targets iOS and Android