SynkLoader: When a Teams Message Fakes Your Lock Screen

Microsoft Teams phishing is once again being used as the doorway to deliver malware, this time a new family called SynkLoader. An account using a company.onmicrosoft.com address, Microsoft 365's default domain for organizations, contacts a target under the name "IT Service Desk," borrowing the trust employees place in internal support. The attacker persuades the user to download and run an MSI installer from a Microsoft Azure file storage endpoint, which makes the file look as though it came straight from Microsoft. The installer presents itself as a helpful utility called "PowerShell Cleaner" and serves as the first stage of the attack.

Once launched, the MSI drops a PowerShell script and a ZIP archive into the user's local application-data folder and runs the script automatically. The script opens a hidden PowerShell window and rebuilds its real payload from hex-encoded values, then decodes and decrypts a Base64, AES-CBC-protected command that runs entirely in memory, leaving nothing on disk from that point on. It unpacks a self-contained Python environment and launches the main loader (ss.py). The loader picks one of three hardcoded C2 domains, beacons every 90 to 120 seconds, and encrypts its traffic with a modified ChaCha20 cipher keyed to a unique victim ID. Whatever Python code the server returns is run straight through exec, giving the operators arbitrary code execution. Persistence is handled by a module that manually maps a DLL into memory and creates a scheduled task through the Task Scheduler COM interface rather than the schtasks command line, sidestepping many behavioral detections. The task relaunches the loader at every logon and again daily at 10 a.m.

After the loader checks in and profiles the machine, the operators push modules built for moving deeper into the network. The PhishLocker module renders a near-perfect copy of the Windows lock screen to trick the user into typing their password, capturing the raw credential instead of a hash and avoiding noisy tools like Mimikatz. Because many organizations rely on single sign-on, that one password opens the door to far more than the local machine. A companion TrafficRedirector module acts as a backconnect reverse proxy, connecting outward to the attacker's server and then relaying traffic to any internal or external endpoint the operators choose. Combined with the stolen password, this lets the attackers sign into corporate systems from the victim's own device and IP address, avoiding alerts tied to unfamiliar logins or geolocations.

Reconnaissance and remote control round out the toolkit. A system profiler gathers the hostname, logged-on user, privilege level, running processes, installed services, the Active Directory domain name, and a count of how many computers are joined to the domain, using a fake msvcp150.dll that quietly runs PowerShell in memory. An interactive shell module lets the operators run PowerShell commands in real time for hands-on-keyboard activity, and a VNC module named StreamMaster streams screenshots of the live session and relays mouse and keyboard input back to the attacker. Traffic to the C2 stays encrypted throughout. Researchers found no reliable attribution but assessed with low-to-medium confidence that the heavy focus on measuring Active Directory size points toward a ransomware group or an initial access broker who sells access to one.