There’s a new malware circus in town and the ringleader goes by “SynkLoader.” Spread via Microsoft Teams messages that pretend to be your friendly (not) IT help desk, it tricks people into installing a bogus “PowerShell Cleaner” MSI that actually installs a whole toolkit designed to quietly snatch credentials and poke around corporate networks.

How the scam works

Attackers message victims through Teams, impersonating internal IT, and ask them to download a supposedly helpful MSI hosted on cloud storage. The installer unpacks a PowerShell script and a ZIP stuffed with a small Python runtime, malicious Python code, precompiled libraries, and some fake Microsoft runtime DLLs — all engineered to look legit. Analysis of the samples shows compile timestamps pointing to initial activity around July 28, 2026.

SynkLoader gets its name because the malware authors apparently like a blender: modules combine Python, PowerShell, C#, and C++—sometimes several languages in a single module. The attackers don’t deploy everything to every victim; they profile the breached environment and only enable the components that fit their game plan.

Modules, risks, and how to defend

Researchers who set up a decoy system to talk to the attackers documented multiple modules. Here’s the cheat-sheet version of what SynkLoader can do:

  • System Profiler — Gathers hostname, username, privilege level, running processes and services, domain info, and an estimate of Active Directory size.
  • Persistence Module — Drops a randomly named scheduled task so the malware runs at logon and once daily.
  • PhishLocker — Pops up a very convincing fake Windows fake lock screen to try and capture the user’s account password.
  • TrafficRedirector — Spins up a reverse proxy so attackers can reach internal services or route web traffic through the compromised machine.
  • Interactive Shell (RAT) — Lets attackers run PowerShell commands remotely and get the results back.
  • StreamMaster (VNC) — Streams the desktop and allows remote mouse/keyboard control of the active session.
  • Module Status Script — Reports which modules and threads are currently up and running.

The PhishLocker bit is the juicy part: it’s designed to harvest your Windows password. If attackers get both valid credentials and a tunneling channel, they can hop back into corporate systems and often bypass IP allow-lists and other network restrictions.

Helpful reality checks: the fake lock screen is really just a full-screen borderless GUI app. Try Alt+Tab to see if other windows peek through, or press Ctrl+Alt+Delete — a real Windows lock screen will behave differently. Also, never install unsolicited MSI files just because someone in Teams told you to.

One practical annoyance for defenders: module hashes change per infection, so file hashes aren’t a reliable detection hammer. Instead, focus on behavioral signals, unusual scheduled tasks, unexpected local proxies, and the presence of the unpacked PowerShell and Python components.

A couple of broader takeaways: once attackers have valid credentials, defensive coverage drops a lot — there’s data showing only about 37% of actions are blocked after credential compromise — so preventing that first credential loss is critical. Verify any IT-style request independently, treat Teams links and downloads with suspicion, and educate users to use Ctrl+Alt+Delete or Alt+Tab when an unexpected lock screen appears.

In short: SynkLoader is messy, multilingual, and built to be flexible. It’s not elegant, but it’s effective — so keep your skepticism switched on and your installations tightly controlled.