Security researchers identified a phishing campaign through Microsoft Teams distributing a new malware family known as SynkLoader, in which the attackers impersonate the technical support office of the targeted company. Rather than merely stealing login credentials through a web page, the campaign persuades the victim to install a malicious MSI file named “PowerShell Cleaner,” hosted on Microsoft Azure to make the download appear more trustworthy.
Expel identified traces indicating that SynkLoader was first compiled and distributed around July 28, 2026. The installer extracts a PowerShell script named cleaner.ps1, along with a ZIP archive containing a Python framework, a malicious script, embedded Python libraries, and several fake DLL files attributed to the Microsoft environment.
Multicomponent, Multilanguage Malware
Expel named the family SynkLoader because of its unusual composition, which combines Python, PowerShell, C#, and C++, with the possibility of using up to three programming languages in a single component. The attackers select the modules they install according to the characteristics of the compromised environment and the objectives of the operation.
While setting up a simulated environment connected to the command-and-control server, the researchers observed modules that collect the hostname, username, privilege level, processes, services, domain details, and the number of devices in Active Directory. The persistence module also creates a scheduled task with a random name to run the malware when the user logs in and daily at 10 a.m.
The family also includes a TrafficRedirector module that creates a reverse proxy, enabling access to internal network services or routing Internet traffic through the infected device; an interactive shell module for remotely executing PowerShell commands; and a VNC module named StreamMaster for streaming the desktop and controlling the mouse and keyboard. Another module sends the status of the modules and active software threads to the attacker.
Fake Lock Screen for Capturing the Password
The most prominent component is PhishLocker, which displays a lock screen that looks like a genuine Windows screen and requests the user account password. Attackers can use the stolen password with the tunneling module to access the company environment from the infected device, potentially bypassing IP address-based access restrictions.
However, Expel noted that the screen is not a real system lock, but rather a borderless graphical application running in full-screen mode. This can be detected by pressing Alt+Tab, which causes the active windows to appear above the fake screen. Ctrl+Alt+Delete can also be tried to verify the nature of the screen.
Why Does This Matter?
SynkLoader’s focus on measuring the size of the Active Directory environment, along with its ability to execute commands and access internal services, suggests that it may be used in operations associated with ransomware, according to an interpretation by Marcus Hutchins of Expel. The company was able to confirm that the activity was a real targeted attack after it deployed an emulator for the reverse shell module; the attacker attempted to run commands to gather information about the environment before discovering that it was not real and disconnecting.
Expel provided indicators of compromise for the campaign, but explained that the fingerprints of SynkLoader modules vary from one infection to another, reducing the value of relying on hashes alone for defense. In practice, the campaign highlights the importance of independently verifying any request originating from technical support, avoiding the installation of unsolicited MSI files, and not considering Azure hosting evidence that a file is safe.