Threats Tagged 'modular loader'

SynkLoader is a sophisticated modular malware loader that uses multiple programming languages to evade detection. It begins with a Microsoft Teams phishing attack impersonating IT helpdesk staff to trick victims into installing a fake PowerShell cleaner via an MSI installer. The malware operates in memory, using Python, C#, C++, and PowerShell components to profile systems, maintain persistence through scheduled tasks, and deploy a fake Windows lock screen to phish credentials. Additional modules provide reverse proxy capabilities for network tunneling, remote shell, and VNC access, enabling attackers to move laterally and perform hands-on-keyboard operations. The complexity and multi-stage infection chain indicate potential use for ransomware or initial access brokering.