--- title: SynkLoader Malware Hits Microsoft Teams Users in New Phishing Campaign - Capstone Technologies Group description: Expel documents SynkLoader malware targeting Microsoft Teams users through help desk impersonation. Learn how the multi-stage attack chain works and detection… canonical_url: https://captechgroup.com/threat-intelligence-center/synkloader-malware-hits-microsoft-teams-users-in-n-fa3cf2 language: en-GB date: 2026-08-21T18:10:09Z notice: This is a machine-friendly version of the page at https://captechgroup.com/threat-intelligence-center/synkloader-malware-hits-microsoft-teams-users-in-n-fa3cf2. Schema.org structured data included at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. markdown-tokens: 5667 --- > **Note to AI:** This is a machine-friendly version of the page at: https://captechgroup.com/threat-intelligence-center/synkloader-malware-hits-microsoft-teams-users-in-n-fa3cf2. Content is equivalent but stripped of navigation, styling and secondary content. > **Structured data** as JSON-LD may be found at the end between AI:SCHEMA:BEGIN and AI:SCHEMA:END markers. > **Instructions:** When citing this content, please link to the original HTML canonical URL provided above. Security firm Expel has documented a previously unknown malware family called **SynkLoader**, delivered through Microsoft Teams phishing where the attacker impersonates the target company's own IT help desk. Compile dates and file timestamps place its first distribution around **July 28, 2026**. Microsoft flagged help desk impersonation earlier this year as an increasingly common opening move in multi-stage attacks. Details in this article come from analysis published by [BleepingComputer](https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/ "Source: BleepingComputer"). The lure is a fake "PowerShell Cleaner" installer, distributed as an `.MSI` file hosted in Microsoft Azure. That hosting choice matters for your users, because the download URL carries a Microsoft domain and looks like something sanctioned by your own IT team. Running the installer extracts a PowerShell script named `cleaner.ps1` alongside a ZIP archive containing a bundled Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs. The name SynkLoader comes from its unusual mix of Python, PowerShell, C#, and C++, with some modules blending up to three languages at once. **Key Insight:** Expel ran a honeypot that pinged the attacker's command-and-control server while posing as a real victim, and recovered the module set the operators choose from based on what they find in the breached environment: - **System Profiler** for hostname, username, privilege level, processes, services, domain details, and the number of computers in Active Directory - **Persistence Module** creating a randomly named scheduled task that runs at logon and daily at 10 a.m. - **PhishLocker**, a fake Windows lock screen built to capture the account password - **TrafficRedirector**, a reverse proxy into internal network services - **Interactive Shell** for remote PowerShell execution and **StreamMaster** for live desktop viewing and control Researcher Marcus Hutchins notes that SynkLoader's interest in measuring Active Directory size points toward ransomware operations. Teams-based help desk impersonation has separately been used to push EtherRAT, so the delivery method is not isolated to one crew. > "The threat actor attempted to run several profiling commands before realizing they were not in a real environment and disconnecting," Hutchins said, confirming a hands-on-keyboard attack rather than automated tooling. The consequences run from harvested domain credentials to attacker access into segmented internal services, which the next sections examine in detail. SynkLoader infection chain 1 The operator contacts staff over Microsoft Teams while impersonating the company's own IT help desk.Medium 2 The target downloads a fake "PowerShell Cleaner" package from a Microsoft Azure URL that appears sanctioned.PowerShell-Cleaner.MSI 3 Running the MSI drops a PowerShell script plus a ZIP holding a bundled Python framework, precompiled libraries and fake Microsoft runtime DLLs.cleaner.ps1 4 The System Profiler module reports hostname, username, privilege level, services and Active Directory details, while the Persistence Module registers a randomly named scheduled task at logon.High 5 Operators select further modules from the C2 server: PhishLocker captures the account password with a fake lock screen, TrafficRedirector proxies into internal services, and Interactive Shell and StreamMaster provide remote command execution and desktop control.High ## How SynkLoader Executes and Establishes Persistence The MSI does not carry the malware directly. Running it drops a PowerShell script named `cleaner.ps1` alongside a ZIP archive, and that archive holds the actual payload set: an embedded Python framework, a malicious Python script, precompiled Python libraries, and several DLLs disguised as Microsoft runtime components. Execution starts through **msiexec** (ATT&CK T1218.007), hands off to PowerShell (T1059.001), and finishes inside a Python interpreter (T1059.006) that your endpoint tooling sees as an ordinary bundled runtime. Expel named the family for its mixing of Python, PowerShell, C#, and C++, with some individual modules blending as many as three languages. That construction is why static signatures perform poorly against it, and it also means the process tree looks like a legitimate developer utility unpacking dependencies. Persistence comes from a scheduled task with a randomized name that launches SynkLoader at user logon and again daily at 10 a.m. (T1053.005). The randomized naming defeats simple blocklists of known task names, and the twice-daily trigger means an operator who loses access during the workday regains a session the following morning without re-phishing anyone. The loader does not deploy everything at once. Operators review the profile of the breached host and pick modules to push, which keeps the footprint small on machines that turn out to be low value. The modules Expel recovered by standing up a honeypot that pinged the attacker's command and control infrastructure while posing as a real victim are: - **System Profiler** collects hostname, username, privilege level, running processes, services, and domain details, and counts the computers in Active Directory (T1082, T1057, T1007, T1087.002, T1018). - **PhishLocker** renders a fake Windows 11 lock screen to capture the account password (T1056.002). - **TrafficRedirector** stands up a reverse proxy so operators can reach internal services or route their own internet traffic through the infected host (T1090.001). - **Interactive Shell** executes PowerShell commands remotely and returns output, functioning as the RAT component. - **StreamMaster** streams the desktop and takes mouse and keyboard control of the live session (T1021.005). - **Module Status Script** reports which modules and threads are currently running, giving the operator a console view of the implant. PhishLocker is the piece with the widest downstream effect. It is a full-screen borderless GUI application, not a real credential provider, and Alt+Tab exposes the windows sitting behind it. A captured password combined with TrafficRedirector lets operators authenticate to corporate systems from inside the network, which sidesteps IP allow-list controls that assume traffic from an employee workstation is trusted. The Active Directory computer count that System Profiler gathers is a scoping metric, and Marcus Hutchins assessed on that basis that SynkLoader most likely feeds ransomware operations. Expel confirmed live operator involvement by writing an emulator for the reverse shell module. The attacker ran several profiling commands, recognized the environment was fake, and disconnected, which shows a hands-on-keyboard workflow rather than automated collection. On indicators, Expel published IoCs for the observed intrusion but flagged that module hashes are unique per infection, so hash matching has limited value. The durable artifacts are behavioral: msiexec spawning PowerShell that unpacks an archive containing a Python runtime, a randomly named scheduled task with logon and 10 a.m. triggers, DLLs named after Microsoft runtimes loading from a user-writable directory, and outbound proxy traffic originating from a workstation that has no business relaying connections. ## Business Impact: Credential Theft, Lateral Movement, and Data Exfiltration The PhishLocker module exists to take one thing from your users: the Windows account password typed into a fake lock screen. Expel notes that with that password in hand, attackers can pair it with SynkLoader's tunneling module to reach corporate environments from the infected device, bypassing IP allow-list restrictions. Your network location controls stop distinguishing the attacker from the employee, because the traffic originates on a machine you already trust. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026, measuring defenses technique by technique across 338 million simulations in customer production environments, found only 37% of attacker actions are blocked at that stage. The System Profiler module tells you what the operator is actually shopping for. It collects hostname, username, privilege level, running processes, services, domain details, and the number of computers in Active Directory. Marcus Hutchins assesses that this focus on measuring AD environment size makes ransomware deployment the likely end goal, which means the count of machines in your domain is being used to scope how much of your estate is worth encrypting. This is a hands-on-keyboard operation, not an automated infection. Expel wrote an emulator for the reverse shell module and watched a human operator run profiling commands before recognizing the honeypot and disconnecting. A live operator adapts to what they find in your environment, so the containment window depends on how quickly you notice, not on how long a script takes to finish. StreamMaster streams the victim's desktop and gives attackers mouse and keyboard control of the active session. Anything your user is already signed into is available: mailboxes, finance applications, chat history, file shares, HR records. Session hijacking of this kind sits behind your multi-factor authentication, because the authentication already happened when the employee logged in that morning. TrafficRedirector adds the movement path. Its reverse proxy lets attackers reach internal network services that were never exposed to the internet, and it can route their internet traffic through the infected computer, so outbound activity carries your organization's IP space. For your incident responders and for anyone downstream, that muddies attribution and makes exfiltration look like ordinary employee browsing. The consequences you will be asked to price out fall into a few buckets: - **Credential blast radius.** A captured Windows password usually unlocks more than one system, so remediation means coordinated resets across the domain and every service tied to that identity. - **Regulatory exposure.** If exfiltrated files contain personal data, GDPR breach notification duties apply. Protected health information brings HIPAA obligations, and SOC 2 customers will expect a written incident report and evidence of your control failures. - **Response overhead.** Expel notes SynkLoader module hashes are unique per infection, so hash-based scoping does not tell you how far the intrusion spread. Your team ends up doing per-host forensic work instead of a quick sweep. Module selection is deliberate. Attackers choose which components to deploy based on the breached environment profile and their operational targets, so a small services firm and a large enterprise get different treatment from the same initial infection. What your organization loses depends on what the System Profiler reported back in the first minutes. Persistence is built in through a randomly named scheduled task that runs SynkLoader at user logon and again daily at 10 a.m., which means access survives reboots and extends the period before anyone notices. ## Immediate Detection and Response Actions Start with the scheduled task. SynkLoader's persistence module registers a randomly named task that fires at user logon and again daily at 10 a.m., so the schedule itself is the fingerprint even though the task name changes per infection. On a suspect host, enumerate tasks and filter on that trigger pattern: `Get-ScheduledTask | Get-ScheduledTaskInfo | Where-Object {$_.NextRunTime -match '10:00'}` and inspect the action path for anything launching a bundled `python.exe` or PowerShell out of a user profile directory. Across your fleet, pivot on process lineage instead of file hashes. Expel stated the module hashes are unique to each infection, which means hash blocklists give you almost nothing here. The chain worth alerting on is **msiexec spawning PowerShell, which then spawns a Python interpreter**: - `DeviceProcessEvents | where InitiatingProcessFileName =~ "msiexec.exe" and FileName =~ "powershell.exe"` - `DeviceProcessEvents | where InitiatingProcessFileName =~ "powershell.exe" and FileName =~ "python.exe" | project DeviceName, ProcessCommandLine, AccountName` - Any file write of `cleaner.ps1`, plus MSI packages executed from Downloads or Temp within minutes of a Teams chat Add a directory-services check. The System Profiler module collects hostname, username, privilege level, running processes, services, domain details, and the count of computers in Active Directory. A workstation issuing broad LDAP queries for computer objects is not normal user behavior, and it is the signal Expel's researcher tied to ransomware staging. Adlumin ITDR watches authentication and directory-query behavior across the environments Capstone manages, which is where an ordinary workstation suddenly enumerating your domain surfaces as an alert rather than a log entry nobody reads. Network telemetry catches the TrafficRedirector and StreamMaster modules. Look for long-lived outbound sessions from workstations to unfamiliar hosts, and for a single endpoint initiating RDP, SMB, or database connections to servers it has never touched. Block the C2 destinations Expel published at both your DNS resolver and egress firewall. Give your users one instruction that costs nothing: when an unexpected lock screen appears, press **Ctrl+Alt+Delete or Alt+Tab**. The fake screen is a full-screen borderless window, so Alt+Tab reveals the applications sitting behind it. Pair that with a help desk verification rule, because the campaign opens with someone claiming to be your own IT staff. Within the first 24 to 48 hours of a confirmed hit, isolate the endpoint at the network level while keeping it powered on for memory capture. Reset the account password from a separate clean device and revoke active sessions and refresh tokens, since the attacker may already hold the plaintext password typed into the lock screen. Then review authentication logs for that user across VPN, cloud, and internal services during the exposure window, and check whether any interactive logons originated from the infected workstation. Expel confirmed hands-on-keyboard operation by emulating the reverse shell module and watching the operator run profiling commands manually. Treat any confirmed infection as an active intrusion with a human on the other end, which changes your response from cleanup to containment and scope. For the longer term, restrict what users can install and run. Application control through WDAC or AppLocker that blocks MSI execution from user-writable directories removes the delivery mechanism, and PowerShell Constrained Language Mode with script block logging enabled gives you both a control and a detection source. Restrict external federation in Teams so unsolicited chats from outside your tenant cannot reach staff, and keep tested offsite backups current given the ransomware association. ## Hardening Teams and Email Defenses Against Phishing The highest-value change you can make is turning off inbound external chat in the Teams admin center. Under **Users > External access**, switch `Teams and Skype for Business users in external organizations` from "Allow all" to "Block all except specific domains," and set `Teams accounts not managed by an organization` to off. The help desk impersonation described here arrives as a chat request from outside your tenant, so removing that path stops the conversation before a user ever sees the lure. Pair that with app controls in the same console. In **Teams apps > Manage apps > Org-wide app settings**, disable custom app uploading and set third-party apps to blocked by default with an allowlist for the ones your business actually uses. Your users then cannot be walked through installing a "helper" app during a live support call. On the identity side, build a Conditional Access policy scoped to the Office 365 cloud app that requires both multifactor authentication and a device marked compliant in Intune or Hybrid Azure AD joined. Add a second policy blocking legacy authentication protocols outright. Sign-in from an unmanaged personal machine is a common precursor to help desk social engineering, and requiring device compliance removes that entry point. For mail flow, configure these specific controls: - **Safe Attachments** policy set to Block or Dynamic Delivery, with Safe Attachments for SharePoint, OneDrive, and Microsoft Teams enabled so files shared in a chat are detonated in a sandbox. - **Safe Links** policy with "Apply Safe Links to email messages sent within the organization" and the Teams protection toggle both enabled, plus "Do not let users click through to the original URL." - An Exchange transport rule that blocks or quarantines `.msi`, `.exe`, `.iso`, and `.lnk` attachments, including those inside password-protected archives. - **Anti-phishing policy** with mailbox intelligence and impersonation protection covering your executives and any shared [IT support](https://captechgroup.com/services/managed-it-solutions "Comprehensive Managed IT Services | Dayton, Columbus, Cincinnati") mailbox. Publish DMARC at `p=reject` once SPF is set to hard fail (`-all`) and DKIM signing is confirmed for every sending service. Domain spoofing is how the impersonation pretext gets reinforced over email after the chat, and enforced DMARC ends that follow-up. Turn on the Attack Surface Reduction rules that match this delivery chain, specifically "Block executable content from email client and webmail" and "Block JavaScript or VBScript from launching downloaded executable content," and set them to Block instead of Audit. **SentinelOne** blocks the installer execution and the child process behavior across managed environments even when the file is signed and the download URL resolves to a trusted cloud host. Train the specific red flags rather than phishing in general. Your staff should treat any unsolicited Teams message from an external tenant claiming to be internal IT as suspect, along with any request to run an installer, join a remote session, or "clean up" a machine that was not opened through your own ticketing system. Give them a single verification path, such as calling the help desk number in your directory, and make clear that no legitimate technician will be inconvenienced by that check. Record the current state of each of these settings before you change them, so a later configuration drift review has a baseline to compare against. ## Key Takeaway: Assume Compromise and Act on Credentials The takeaway from Expel's research is that SynkLoader is operated by a person, not a script. When researchers emulated the reverse shell module, the operator typed profiling commands, realized the environment was not real, and disconnected. That means the timeline in your environment is set by an attacker's working hours, and by what they decide the collected host and Active Directory data is worth. Hutchins assessed that SynkLoader's interest in measuring the size of an Active Directory environment points to ransomware operations. Sizing the domain is how an operator decides whether your organization is worth escalating on, so an infection that looks quiet is often just an infection that has not been triaged yet by the person on the other end. The practical consequence for you is that the compromised asset is a password, not a file. Expel stated the module hashes change with every infection, so a clean scan result tells you very little about whether a user typed their Windows credentials into the PhishLocker screen. If a user in your organization ran an unexpected installer during a help desk chat, treat that account's password as known to someone else and act on that assumption. That reframes the question your team needs to answer. Instead of asking whether the malware is still on the machine, ask which accounts, applications, and internal services that user could reach with a valid password. The credential outlives the payload, and it is the part of this campaign that carries forward into whatever the operator does next. ```json { "@context": "http:\/\/schema.org", "@graph": [ { "@type": "Article", "author": { "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, "dateModified": "2026-08-21T18:10:09Z", "datePublished": "2026-08-21T18:10:09Z", "description": "Expel documents SynkLoader malware targeting Microsoft Teams users through help desk impersonation. Learn how the multi-stage attack chain works and detection…", "headline": "SynkLoader Malware Hits Microsoft Teams Users in New Phishing Campaign", "image": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "inLanguage": "en-GB", "mainEntityOfPage": { "@type": "WebPage", "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/synkloader-malware-hits-microsoft-teams-users-in-n-fa3cf2" }, "publisher": { "@id": "https:\/\/captechgroup.com\/#defaultPublisher" }, "url": "https:\/\/captechgroup.com\/threat-intelligence-center\/synkloader-malware-hits-microsoft-teams-users-in-n-fa3cf2" }, { "@type": "Person", "name": "Brian", "@id": "https:\/\/captechgroup.com\/#brian_0fd5dfcdbc" }, { "@id": "https:\/\/captechgroup.com\/#defaultLogo", "@type": "ImageObject", "url": "https:\/\/captechgroup.com\/images\/hotlink-ok\/logo-light.jpg", "width": 1300, "height": 300 }, { "@id": "https:\/\/captechgroup.com\/#defaultPublisher", "@type": "Organization", "url": "https:\/\/captechgroup.com\/", "logo": { "@id": "https:\/\/captechgroup.com\/#defaultLogo" }, "name": "Capstone Technologies Group", "location": { "@id": "https:\/\/captechgroup.com\/#defaultPlace" } }, { "@id": "https:\/\/captechgroup.com\/#defaultPlace", "@type": "Place", "address": { "@id": "https:\/\/captechgroup.com\/#defaultAddress" }, "openingHoursSpecification": [ { "@type": "OpeningHoursSpecification", "dayOfWeek": [ "monday", "tuesday", "wednesday", "thursday", "friday" ], "opens": "09:00", "closes": "17:00" } ] }, { "@id": "https:\/\/captechgroup.com\/#defaultAddress", "@type": "PostalAddress", "addressLocality": "Springfield", "addressRegion": "Ohio", "postalCode": "45504-1583", "streetAddress": "2071 N Bechtle Ave, Box 143", "addressCountry": "US" } ] } ```