Full Report
A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]
Analysis Summary
# Tool/Technique: SynkLoader
## Overview
SynkLoader is a multi-stage malware family first identified in 2026. It is primarily distributed via Microsoft Teams phishing campaigns where attackers impersonate IT help desk personnel. The malware is designed for credential theft, internal network tunneling, and remote system control, often serving as a precursor to ransomware operations. It is notable for its "kitchen sink" approach, blending multiple programming languages (Python, PowerShell, C#, and C++) within its modules.
## Technical Details
- **Type:** Malware family (Loader / RAT)
- **Platform:** Windows
- **Capabilities:** System profiling, credential harvesting (fake lock screen), persistence, reverse proxy/tunneling, VNC, and remote shell execution.
- **First Seen:** July 28, 2026
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1566.003 - Phishing: Spearphishing via Service] (Microsoft Teams)
- **[TA0003 - Persistence]**
- [T1053.005 - Scheduled Task/Job: Scheduled Task]
- **[TA0006 - Credential Access]**
- [T1110 - Brute Force] (via PhishLocker/Adversary-in-the-Middle)
- **[TA0007 - Discovery]**
- [T1082 - System Information Discovery]
- [T1018 - Remote System Discovery]
- **[TA0011 - Command and Control]**
- [T1090 - Proxy] (Traffic redirection for internal access)
- [T1219 - Remote Access Software] (VNC/Interactive Shell)
## Functionality
### Core Capabilities
- **System Profiler:** Gathers hostname, username, privileges, and Active Directory environment size.
- **Persistence:** Establishes scheduled tasks for execution at logon and specific daily intervals.
- **Interactive Shell (RAT):** Executes remote PowerShell commands and returns output to the attacker.
- **Module Status Script:** Monitors and reports the health of active malware threads.
### Advanced Features
- **PhishLocker:** A sophisticated full-screen borderless GUI that mimics a Windows 11 lock screen to trick users into entering their passwords.
- **TrafficRedirector:** Creates a reverse proxy that allows attackers to bypass IP-based restrictions by routing traffic through the infected host.
- **StreamMaster (VNC):** Provides real-time desktop streaming and remote control of the victim's mouse and keyboard.
## Indicators of Compromise
- **File Hashes:**
- *Note: Expel reported that module hashes are unique per infection; however, the initial .MSI and core scripts serve as primary identifiers.*
- **File Names:**
- `cleaner.ps1`
- `PowerShell Cleaner.msi`
- **Registry Keys:** N/A (Relies primarily on Scheduled Tasks)
- **Network Indicators:**
- C2 infrastructure hosted on Microsoft Azure (specific IPs/domains defanged in original reporting).
- **Behavioral Indicators:**
- Unsolicited installation of Python frameworks/runtimes via MSI.
- Creation of randomly named scheduled tasks.
- Full-screen GUI applications blocking user interaction.
## Associated Threat Actors
- **Unknown:** While the specific group is not named, the TTPs align with sophisticated Access Brokers or Ransomware Affiliates specializing in social engineering via collaboration platforms.
## Detection Methods
- **Signature-based:** Detection of the `cleaner.ps1` script and suspicious Python-bundled ZIP archives.
- **Behavioral:**
- Monitoring for `msiexec.exe` calling PowerShell to execute scripts from temporary directories.
- Identifying unusual scheduled task creation pointing to Python interpreters.
- Detecting reverse proxy traffic originating from non-admin workstations.
## Mitigation Strategies
- **User Training:** Educate employees to verify IT help desk requests through secondary channels (e.g., official internal chat or phone).
- **Hardening:** Use AppLocker or Windows Defender Application Control (WDAC) to prevent the execution of unsolicited MSI files and unauthorized Python binaries.
- **Response:** If an unexpected lock screen appears, users should attempt **Alt+Tab** or **Ctrl+Alt+Delete** to verify if the screen is a standalone application.
## Related Tools/Techniques
- **Social Engineering:** Similar to "Storm-0324" or "Sliver" delivery via Teams.
- **Credential Phishing:** Similar to "EvilProxy" or "Mishira" but focused on local OS credentials rather than just SaaS tokens.