A new and stealthy malware family, **SynkLoader**, has been identified in active phishing campaigns targeting users via **Microsoft Teams**. The attackers are employing a well-documented tactic: impersonating internal IT help desk personnel to gain trust and facilitate infection. **Expel** security researcher **Marcus Hutchins** highlighted that the campaigns direct victims to download a seemingly legitimate "PowerShell Cleaner" executable (.MSI) hosted on **Microsoft Azure**. This deceptive hosting choice lends an air of authenticity to the malicious download. Analysis of **SynkLoader** indicates its initial compilation and distribution around July 28, 2026. The installer unpacks a PowerShell script, `cleaner.ps1`, and a ZIP archive containing a Python framework, a malicious Python script, precompiled Python libraries, and several fake **Microsoft** runtime DLLs.  *SynkLoader ZIP archive content. Source: Expel* **SynkLoader** derives its name from its unusual combination of programming languages, often blending Python, PowerShell, C#, and C++ within a single module. Depending on the compromised environment and operational objectives, attackers can deploy various modules: * **System Profiler**: Gathers hostname, username, privilege levels, running processes, services, domain details, and Active Directory computer count. * **Persistence Module**: Establishes persistence via a randomly named scheduled task, launching **SynkLoader** at user logon and daily. * **PhishLocker**: Displays a highly convincing fake Windows lock screen to capture user login passwords. * **TrafficRedirector**: Creates a reverse proxy, enabling attackers to access internal network services or route internet traffic through the compromised machine. * **Interactive Shell (RAT)**: Provides remote execution of PowerShell commands. * **StreamMaster (VNC)**: Streams the victim's desktop and allows remote mouse and keyboard control. * **Module Status Script**: Reports on active malware modules and threads.  **The malicious task securing persistence** *Source: Expel* ### Deceptive Windows 11 Lock Screen The **PhishLocker** module stands out for its sophisticated attempt to harvest Windows account passwords. By presenting a near-perfect replica of a Windows lock screen, attackers aim to bypass IP allow-list restrictions and gain direct access to corporate environments using stolen credentials. While the fake lock screen is convincing, **Expel** notes a critical flaw: pressing `Alt+Tab` reveals other active windows, exposing it as a full-screen, borderless GUI application rather than a genuine system lock.  **Alt+Tab exposing the deceptive lock screen** *Source: Expel* **Hutchins** suggests that **SynkLoader**'s focus on Active Directory environment size strongly implies its use in ransomware operations. During their research, **Expel** utilized an emulator for the reverse shell module to confirm the hands-on-keyboard nature of the attack. Attackers attempted several profiling commands before realizing they were in a simulated environment and disconnecting. **Expel** has provided Indicators of Compromise (**IoCs**) for the observed attacks. However, due to the unique hashing of **SynkLoader** modules per infection, these **IoCs** may have limited utility for defenders. The most effective defense remains vigilant verification of IT requests and extreme caution when installing unsolicited MSI files. When confronted with an unexpected lock screen, users should attempt `Ctrl+Alt+Delete` or `Alt+Tab` to verify its authenticity.