SynkLoader Malware Campaign Leverages Microsoft Teams for Credential Theft
A new SynkLoader malware campaign uses Microsoft Teams phishing to deliver a toolkit that steals Windows passwords, posing a significant threat to corporate networks.
A sophisticated malware campaign is exploiting Microsoft Teams to deliver a new toolkit dubbed SynkLoader, designed to steal Windows passwords and facilitate network intrusions. Attackers are impersonating IT helpdesk staff, a tactic that leverages the trust users place in internal support personnel. This social engineering ploy convinces unsuspecting employees to download a seemingly legitimate MSI file, which acts as the initial vector for the malware.
The malicious MSI file, disguised as a "PowerShell Cleaner," unpacks a ZIP archive and a PowerShell script into a user's local application data folder. This script then executes hidden PowerShell commands, paving the way for the main Python-based loader to operate primarily in memory, thus evading traditional disk-based detection methods. The toolkit's components, first observed around late July 2026, include a small Python environment, scripts, compiled libraries, and DLLs, all working in concert to execute commands received from the attacker's control servers.
Once active, the SynkLoader malware establishes a covert communication channel with its command-and-control (C2) infrastructure, rotating among three distinct domains. It checks in with the C2 server every 90 to 120 seconds, ready to execute any Python code returned by the operator. During this phase, the malware diligently collects a wide array of system information, including the computer name, logged-in username, privilege levels, running processes, active services, and Active Directory details. This reconnaissance is crucial for attackers to assess the potential value of a compromised machine.
To ensure persistence, the toolkit installs a scheduled task with a random name. This task is configured to run automatically upon user logon and at a specific local time (10 a.m.), ensuring the SynkLoader can relaunch even after a system restart. This persistence mechanism is designed to be stealthy, avoiding obvious task-creation commands that might trigger security alerts.
Perhaps the most alarming component of the SynkLoader toolkit is PhishLocker. This module mimics the legitimate Windows lock screen, capturing the current username and background to create a convincing full-screen window that prompts users for their password. The explicit goal is to harvest the user's raw Windows password, which is far more valuable than a hashed password, especially in environments utilizing single sign-on (SSO). A captured password can grant attackers broad access to internal network services.
Further extending the threat, a TrafficRedirector module acts as a reverse proxy, enabling attackers to access internal network services or connect to external internet services using the victim's corporate IP address. This capability masks the origin of malicious traffic, making it harder for security teams to trace and block attacks. The researchers also identified modules for remote PowerShell shell access and a VNC-based remote control function, indicating a comprehensive toolkit for post-exploitation activities.
Analysts assess that the SynkLoader toolkit could be operated by ransomware groups or access brokers seeking to gain initial footholds in corporate networks. The campaign highlights the evolving tactics of cybercriminals who leverage trusted communication platforms like Microsoft Teams to bypass security measures and conduct highly effective phishing operations. Security teams are advised to scrutinize external Teams communications, monitor for unauthorized MSI downloads and suspicious scheduled tasks, and inspect for in-memory PowerShell activity. Blocking known C2 infrastructure and preserving Teams audit logs are also critical steps in mitigating this threat.