FHN 
Microsoft Teams is being used in a new phishing campaign to deliver SynkLoader, a malware toolkit designed to gain control of Windows systems.
The attackers impersonate IT support staff and convince employees that they need to install a software fix. What looks like a routine helpdesk request can ultimately give attackers access to the victim’s system and valuable corporate information.
Security researchers at Expel identified the campaign and found that the malware components appeared to have been developed around late July 2026.
Fake IT Support Leads to Malware Infection
The attack begins with a Teams conversation in which the threat actor poses as an internal IT service desk employee.
The victim is then directed to download an MSI file hosted on Azure Blob Storage, making the file appear more trustworthy.
The installer is presented as “PowerShell Cleaner” and drops additional files, including a ZIP archive and PowerShell scripts. These components launch the malware while keeping much of its activity hidden from the user.
SynkLoader can collect detailed information about the infected computer, including:
- Computer and username details
- User privileges
- Running processes and services
- Active Directory information
- System configuration
The malware communicates with attacker-controlled infrastructure at regular intervals and can receive commands or additional Python code.
It also creates a randomly named scheduled task that helps the malware restart after a reboot or user logon.
Fake Windows Lock Screen Steals Passwords
One of the more concerning components is PhishLocker, which displays a fake Windows 11 lock screen.
The screen is designed to look like a legitimate Windows password prompt and attempts to convince the victim to enter their Windows password.
The stolen password could then provide attackers with access to additional corporate services, particularly in environments where the same credentials are used across multiple applications.
Another component, called TrafficRedirector, can act as a reverse proxy through the infected computer. This could allow attackers to access internal services or route internet traffic through the victim’s corporate connection.
Researchers also identified capabilities for remote PowerShell access and VNC-based remote control, giving attackers additional ways to interact with a compromised system.
How Organizations Can Reduce the Risk
Employees should be cautious when receiving unexpected IT support requests through Teams. Any request to install software should be verified through a trusted internal communication channel before proceeding.
Security teams should monitor for:
- Unexpected external Teams communications
- Unapproved MSI downloads
- Newly created scheduled tasks
- Suspicious PowerShell activity
- Unusual in-memory execution
- Connections to known malicious infrastructure
Teams audit logs and endpoint telemetry should also be preserved when investigating suspected infections.
The campaign highlights an important security lesson: trusted communication platforms can become powerful delivery channels when attackers successfully impersonate internal support teams.
IoCs
| Type | Indicator | Description |
|---|---|---|
| URL | https://filereserve.blob.core.windows.net/vgnghuyk/331331.msi | Initial installer URL sent through Teams |
| SHA-256 | 151D2A7F52F047638CA8AD80C859C6BFE04D7510FB10933817FA0E3BA5D07A11 | Initial installer |
| SHA-256 | 80F08360BA768B152B71ABB1CAB557F552A13DE18C83FE8E6396A197FEEC9185 | First-stage payload |
| SHA-256 | 209F69A6CA859F05C954096B30391A43FDA33C9ED264DFDCCF806697F04B06A8 | ZIP archive containing loader |
| SHA-256 | D150C70D2732DF17AA77991B9EBF4C896F044445E900978581D9598DFA5DC98C | Main loader |
| SHA-256 | 61F961CFEBDF9967844526649B4B75BBA5B1B83210B70AA1BFFE3F64E6AC3112 | PowerShell executor DLL |
| SHA-256 | 8207D8D949530EA063FFD5D47EE81B74BF718EC0A4755E2349E6AF9B91E92DC1 | DLL loader |
| SHA-256 | C4ACDA412774C292F0DB5D64467A2DD09282CDEA43C41967E8BF90F6298ACCF3 | Profiling module loader |
| SHA-256 | 63622C1DDB3E2A9F11CAC192E13AC7494F558516B19D5D8F140F6D0D4D38EA84 | Persistence module loader |
| SHA-256 | A335E75B78B601EBC5C258975D95FD79AA21F836FC6B79D82E9A22C596133F07 | Fake lock screen loader |
| SHA-256 | 0428FBDEFA8DDA10CE8FC12B1B516641E83CD5088388168E3F1A0BE1432B4077 | Persistence module DLL |
| SHA-256 | CB1C657F74B9E57F5E81126179128E8DB949D1D4196BE9DCB890341E222FD384 | Fake lock screen DLL |
| Domain | neversoftmain.net | SynkLoader command-and-control domain |
| Domain | rootfarmapp.net | SynkLoader command-and-control domain |
| Domain | tripinupdate.net | SynkLoader command-and-control domain |
| Domain | dondermicapp.net | TrafficRedirector command-and-control domain |
| Domain | aroclenetapp.net | VNC module command-and-control domain |
About the Author
