Threats Tagged 'modular loader'

SynkLoader is a sophisticated modular malware loader that uses multiple programming languages to evade detection. It begins with a Microsoft Teams phishing attack impersonating IT helpdesk staff, tricking users into installing a fake PowerShell cleaner via an MSI installer. The malware operates in memory, using Python, C#, C++, and PowerShell components to profile systems, maintain persistence through scheduled tasks, and display a fake Windows lock screen to steal user credentials. Additional modules provide a reverse proxy for network tunneling, remote shell, and VNC access, enabling attackers to move laterally within corporate networks. The complexity and multi-stage infection chain suggest its use for ransomware deployment or initial access brokering.