SynkLoader Malware Fakes Windows Lock Screen to Steal Passwords

SynkLoader Malware Is Posing as Your IT Helpdesk on Microsoft Teams — Here's How It Steals Your Password

It's 2:47 PM on a Tuesday. Sarah, a project coordinator at a mid-sized logistics firm, gets a Teams message from "IT Support - Help Desk." The profile picture looks legit. The message is polite, urgent-but-not-panicked, exactly the tone real IT staff use: "Hi Sarah, we've flagged some performance issues on your machine tied to a pending security patch. Can you run a quick cleaner tool so we can close the ticket?"

She clicks the link. Downloads an MSI. Runs it. Nothing visibly happens — maybe a flicker, maybe nothing at all. She shrugs and gets back to her spreadsheet.

What she doesn't know is that she just handed an attacker a working foothold inside her company's network — no phishing email, no suspicious attachment, no obvious red flag. Just a Teams chat that felt completely normal.

This is SynkLoader, a newly identified malware loader that security researchers say is actively being used against enterprise users right now. If your organization relies on Microsoft Teams for internal support (and whose doesn't?), this is a threat you need to understand today, not next quarter.

Table of Contents

• What Is SynkLoader?
• The Full Attack Chain, Step by Step
• PhishLocker: The Fake Lock Screen That Steals Passwords
• Why This Attack Is So Effective
• Indicators of Compromise (IOCs) to Watch For
• Detection Techniques for SOC Teams
• Prevention Strategies for Organizations
• Expert Tips From the Field
• Related Reading
• FAQ
• Conclusion

What Is SynkLoader?

SynkLoader is a modular, multi-stage malware delivery platform first observed being compiled and distributed around July 28, 2026. Researchers at ReliaQuest Threat Research, who shared their findings with Cyber Security News, describe it as a hash-gated PowerShell loader — meaning it deliberately reveals very little of its behavior when researchers or automated sandboxes try to inspect it.

What makes SynkLoader stand out isn't just the code. It's the delivery method. Instead of relying on email attachments, malicious links, or drive-by downloads — the stuff most email security gateways are tuned to catch — SynkLoader spreads through direct social engineering on Microsoft Teams, combined with old-fashioned vishing (voice phishing) calls.

The malware itself is built across multiple languages — Python, PowerShell, C#, and C++ — and is designed to run largely in memory, which makes it harder for traditional endpoint detection and response (EDR) tools to catch it using file-based signatures.

The Full Attack Chain, Step by Step

Understanding this attack means walking through it the way a SOC analyst would reconstruct it after the fact. Here's how it typically unfolds:

1. Initial contact: The attacker reaches out via a Microsoft Teams message or a phone call, impersonating internal IT or helpdesk staff. Some campaigns use self-registered Microsoft 365 tenants to make the outreach look more convincing.
2. The pretext: The "technician" claims there's a pending performance issue, failed update, or required security patch, and offers to walk the user through a fix.
3. The payload delivery: The victim is directed to download a fraudulent MSI installer branded as "PowerShell Cleaner." Crucially, it's hosted on Azure Blob Storage — legitimate Microsoft infrastructure that most web filters won't flag as suspicious.
4. Execution: Running the MSI extracts a PowerShell script named cleaner.ps1, along with a ZIP archive containing a stripped-down Python framework, a malicious Python script, precompiled Python libraries, and DLL files disguised as legitimate Microsoft runtime components (such as a fake msvcp150.dll).
5. In-memory staging: The script decodes and decrypts follow-on commands in memory, then unpacks the Python environment into a randomly named folder under AppData, launching the core loader script (often referred to as ss.py) via pythonw.exe.
6. Command-and-control: The loader reaches out to attacker infrastructure using an encrypted C2 channel — researchers have observed a modified ChaCha20 implementation — to pull down additional modules.
7. Host profiling: Before deploying its heavier tools, SynkLoader quietly profiles the machine: hostname, domain membership, user privilege level, running processes, and — notably — the size of the Active Directory environment. That last detail is a strong signal this is about scoping a target for a bigger payoff, not just petty credential theft.

PhishLocker: The Fake Lock Screen That Steals Passwords

The most dangerous module in SynkLoader's toolkit is called PhishLocker, and it's worth understanding on its own because it targets something most security awareness training doesn't cover: the Windows lock screen itself.

PhishLocker throws up a full-screen GUI designed to look exactly like a real Windows 11 lock screen, often with messaging like "Windows Update Failed" or "Security Verification Required." The user, assuming their session simply locked, types in their password to unlock it.

Here's the catch: it's not a real lock screen. It performs no actual authentication. It accepts any input, silently captures the raw plaintext password, and sends it straight to the attacker. It also continuously refocuses itself to defeat Alt+Tab attempts, making it hard to switch away from.

Because PhishLocker captures the raw password rather than a password hash, it sidesteps detection tools built around hash-based credential theft (like Mimikatz detection rules). And in environments using single sign-on, a single captured password can unlock far more than one machine.

Beyond PhishLocker, researchers have documented additional modules bundled with SynkLoader infections:

• Interactive Shell (RAT): Lets attackers remotely execute PowerShell commands and view the output — essentially hands-on-keyboard access.
• StreamMaster (VNC): Streams the victim's desktop and gives the attacker remote mouse and keyboard control of the active session.
• TrafficRedirector: Builds a reverse proxy/tunnel, letting attackers reach internal network services from the outside — potentially bypassing IP allow-list protections many organizations lean on.
• Persistence mechanism: A scheduled task with a randomized name, configured to relaunch the loader at user logon and again at a fixed daily time.

Why This Attack Is So Effective

None of this relies on a software vulnerability. There's no CVE to patch here. The entire chain hinges on one thing: trust in a familiar communication channel.

Most organizations have spent years training employees to be suspicious of email attachments and sketchy links. Fewer have trained staff to question a Teams message that looks like it's coming from internal IT — because, historically, that channel felt safe by default.

Layer on top of that the use of Azure Blob Storage for hosting the payload, and you get a download URL that looks, on the surface, like legitimate Microsoft infrastructure. Many secure web gateways and URL reputation tools won't blink at an azureblob.windows.net link the way they would at a random domain registered last week.

Security researcher Marcus Hutchins has assessed, with low-to-medium confidence, that SynkLoader is tied to a ransomware group or an initial access broker — pointing to its habit of counting Active Directory-joined systems, a metric typically used to size up potential ransom demands before a bigger operation begins.

Indicators of Compromise (IOCs) to Watch For

While specific hashes and infrastructure rotate frequently (SynkLoader reportedly uses unique module hashes per infection to defeat hash-based detection), SOC teams should hunt for these behavioral patterns:

Indicator Type	What to Look For
File artifact	MSI installer branded "PowerShell Cleaner" or similar naming
Script name	cleaner.ps1 executing from a temp or AppData path
Process	pythonw.exe launching from a randomly named AppData subfolder
DLL masquerading	Fake msvcp150.dll or similar "Microsoft runtime" files that don't match legitimate signed versions
Scheduled task	Randomly named scheduled task with logon trigger plus a fixed daily time trigger
Network	Outbound connections to Azure Blob Storage URLs immediately followed by unusual Python/PowerShell process activity
UI anomaly	A "lock screen" that does not respond to Ctrl+Alt+Delete or accepts any password input

Detection Techniques for SOC Teams

Because SynkLoader is engineered to look "quiet" to static analysis, detection needs to lean on behavior, not just signatures.

1. Hunt for anomalous Python execution. Most standard corporate endpoints have no legitimate business reason to spin up pythonw.exe from a randomly generated AppData directory. Flag this as high-priority.

Get-Process pythonw | Select-Object Path, StartTime, Id

This PowerShell command lists any running pythonw.exe processes along with their file path and start time. Use it during live incident triage to quickly confirm whether Python is running from an unexpected AppData location. Expected output on a clean endpoint: no results, or a result from a known, IT-approved Python install path.

2. Audit scheduled tasks for randomized names. Legitimate scheduled tasks generally follow predictable naming conventions tied to installed software. A randomly generated task name with both a logon trigger and a fixed daily time trigger is a strong anomaly signal.

Get-ScheduledTask | Where-Object {$_.TaskName -match '^[a-zA-Z0-9]{8,12}$'} | Select-Object TaskName, State

This filters scheduled tasks for names matching a random alphanumeric pattern, which is how many loader-based malware families name their persistence tasks. It won't catch every case, but it's a fast triage step. Review any matches manually before taking action — some legitimate software also uses randomized task names.

3. Monitor Teams for external tenant contact. Microsoft Defender for Office 365 and Teams admin center logs can reveal messages originating from external or newly registered Microsoft 365 tenants impersonating internal departments. Correlate any "IT Support" contact from an external tenant ID against your known internal helpdesk tenant.

4. Flag DLL files that don't match signed Microsoft binaries. A file named msvcp150.dll sitting in a user-writable directory, unsigned or signed by an unrelated certificate, is a red flag worth an automated EDR rule.

Warning: Any remediation steps involving process termination, scheduled task deletion, or DLL removal should go through your incident response playbook — don't run destructive cleanup commands on a live suspected-compromised host before forensic evidence (memory dump, process tree, network connections) has been captured.

Prevention Strategies for Organizations

• Train employees on Teams-based impersonation, not just email phishing. Awareness programs need an explicit module on "your IT helpdesk will never cold-message you asking you to install a tool" — because right now, most training skips this entirely.
• Establish a verified support channel. Require employees to initiate IT requests through a known ticketing system rather than accepting inbound "support" messages at face value. Publish this policy company-wide.
• Restrict external Teams communication where feasible, or configure Teams to visually flag messages from external tenants so employees can spot impersonation attempts at a glance.
• Block unsanctioned MSI execution via application allow-listing (AppLocker or Windows Defender Application Control) so unapproved installers can't run even if downloaded.
• Monitor Azure Blob Storage download patterns at the network layer — legitimate business use of Blob Storage is usually predictable; sudden spikes tied to new endpoints are worth investigating.
• Teach the Ctrl+Alt+Delete test. A real Windows lock screen responds to Ctrl+Alt+Delete or Alt+Tab in specific, predictable ways. A fake one, like PhishLocker, either ignores the input or behaves inconsistently. This is a simple, memorable check any employee can use in the moment.
• Enforce MFA everywhere — while PhishLocker steals a raw password, strong MFA (especially phishing-resistant methods like FIDO2 keys) limits what that stolen credential can actually unlock.

Expert Tips From the Field

If you're running a SOC, treat any unsolicited "IT support" contact through Teams the same way you'd treat an unsolicited email attachment: guilty until proven innocent. Build a Teams-specific phishing reporting button if your tenant supports it, and make sure employees know it exists.

For threat hunters, don't just hunt for SynkLoader's specific hashes — they rotate per infection. Hunt for the pattern: Teams-based social engineering leading to an MSI download from cloud storage, followed by Python execution from a non-standard path. That behavioral chain is far more durable than any single IOC.

For CISOs, this is a good moment to revisit your organization's IP allow-list assumptions. SynkLoader's TrafficRedirector module is specifically built to tunnel around that control — meaning a single compromised endpoint with valid credentials could undermine a security layer you're relying on heavily.

Related Cybersecurity Topics You Should Explore

• SysScan Scam: Fake Microsoft Alert Tricks Users Into Deleting AV
  
• 768 Leaked AWS Keys Still Have Full Admin Access in 2026
  
• Enable Maximum Windows Logging for SOC & Ransomware Detection
  
• OpenBin.ai & OpenAPK.ai Review: Free AI Reverse Engineering Tool
  
• Grok Zero-Click Hack Steals Your Chats — No Click Needed
  
• head Command in Linux: Fast Log Triage for SOC Analysts
  
• Elementor Pro Bug Lets Hackers Upload PHP — No Login Needed
  
• tac Command Tutorial: Reverse Logs Fast for Faster Threat Detection
  
• ToxicPanda 2.0: The Android Trojan Now Hacking 349 Banks
  
• Windows 11 24H2 Support Ends Oct 13 — Are You at Risk?
  
• Cat Command in Linux: The SOC Analyst's Secret Weapon
  
• How a Fake VNC Login Turned Into Full Root Access on macOS
  
• reconFTW Tutorial: The Recon Tool That Found My Hidden Bounty
  
• TP-Link Router Flaw Lets Hackers Skip Login Entirely — Here's What's at Risk
  
• This subfinder Fork Cuts Recon Time in Half — subfaster Review
  
• 737 Fake VPN Extensions Are Spying on Chrome Users Right Now

FAQ

Q: Is SynkLoader a virus, a trojan, or ransomware?
A: It's best described as a loader — a delivery platform that installs other malicious modules like a credential stealer, a RAT, and a VNC tool. Researchers believe it may serve as an initial access mechanism that could hand off to a ransomware operation, rather than being ransomware itself.

Q: How does SynkLoader initially get onto a machine?
A: Through social engineering on Microsoft Teams — either a chat message or a vishing call impersonating internal IT support — that convinces the victim to download and run a fake "PowerShell Cleaner" MSI installer.

Q: Why is it hard for antivirus tools to catch?
A: It's a hash-gated loader that runs mostly in memory, uses per-infection unique module hashes, and hosts its payload on legitimate Azure infrastructure — all of which reduce the effectiveness of traditional signature-based detection.

Q: What is PhishLocker exactly?
A: A module within SynkLoader that displays a convincing fake Windows 11 lock screen to trick victims into typing in their real password, which is then captured and sent to the attacker.

Q: Can multi-factor authentication stop this attack?
A: MFA won't stop the initial credential theft, but strong, phishing-resistant MFA (like FIDO2 security keys) significantly limits what an attacker can do with a stolen password alone.

Q: How can an employee tell if a Teams message from "IT support" is fake?
A: Be suspicious of any unsolicited message asking you to download and run software, especially urgent ones. Verify through your organization's official ticketing system before taking action, and check whether the sender is from an external tenant.

Q: What should I do if I already ran the installer?
A: Disconnect the machine from the network immediately, do not attempt to fix it yourself, and report it to your security team right away so they can investigate before any cleanup destroys forensic evidence.

Conclusion

SynkLoader is a reminder that the weakest link in enterprise security isn't always a missing patch — sometimes it's a Teams chat that feels just familiar enough to trust. By combining legitimate Microsoft infrastructure, in-memory execution, and a genuinely convincing impersonation of internal IT, this campaign is built to slide past both human instinct and a lot of automated defenses.

The good news: none of this requires exotic defenses to counter. Verified support channels, application allow-listing, phishing-resistant MFA, and a workforce trained to question unsolicited "IT help" go a long way. If you found this breakdown useful, share it with your security team, and drop a comment if you're seeing similar Teams-based impersonation attempts in your own environment — tracking these patterns across organizations is how the community stays ahead of campaigns like this one.