SynkLoader is a previously unknown malware family distributed through Microsoft Teams phishing campaigns that impersonate corporate IT help desks. The attack delivers a fake 'PowerShell Cleaner' MSI installer hosted on Microsoft Azure. The malware extracts a PowerShell script and a ZIP archive containing Python frameworks, malicious scripts, and fake DLLs. SynkLoader's modular design includes components for system profiling, persistence via scheduled tasks, credential theft through a fake Windows lock screen (PhishLocker), traffic redirection via a reverse proxy, remote PowerShell command execution, and desktop streaming with remote control. The PhishLocker module attempts to capture Windows account passwords by displaying a full-screen borderless GUI mimicking the lock screen, which can be exposed by Alt+Tab. The malware focuses on Active Directory environment profiling, suggesting use in ransomware operations. Unique module hashes per infection limit signature-based detection. Best practices include independent verification of IT requests and using Ctrl+Alt+Delete or Alt+Tab to detect fake lock screens.

Successful compromise allows attackers to steal Windows account credentials, enabling them to bypass IP allow-list restrictions and gain persistent access to corporate environments. The malware's modules enable extensive reconnaissance, persistence, credential theft, network traffic redirection, and remote control of infected systems. This facilitates hands-on-keyboard attacks and potentially supports ransomware operations. The fake lock screen can deceive users into disclosing passwords, increasing the risk of credential theft and lateral movement within networks.

No official patch or vendor advisory is available for SynkLoader malware. Mitigation focuses on user awareness and operational security: independently verify all IT help desk requests, especially those delivered via Microsoft Teams or unsolicited MSI installers. Avoid installing unrequested software. When encountering unexpected lock screens, use Ctrl+Alt+Delete or Alt+Tab to verify authenticity, as the fake lock screen is a full-screen application that can be exposed by these key combinations. Employ endpoint detection and response solutions capable of detecting suspicious scheduled tasks and unusual network proxies. Monitor for unusual PowerShell activity and network traffic redirection. Since module hashes vary per infection, rely on behavioral detection rather than signature-based methods.