New SynkLoader malware pushed in Microsoft Teams phishing campaign

If your company runs Microsoft Teams, one of your employees could get a message today from "IT Helpdesk" asking them to install a cleanup tool. It looks internal. It isn't. A newly documented malware family called SynkLoader is being pushed through exactly that lure, and it doesn't stop at stealing a password — it profiles your whole Active Directory environment on the way out.

For a 20-person SaaS company, this matters more than it would at a big enterprise. There's no security operations team watching Teams traffic, no help desk to call and double-check "did you really message me?" — the employee's only signal is whether the message looks plausible, and this one is built to.

What actually happened

According to BleepingComputer, attackers are impersonating a target company's own IT help desk directly inside Microsoft Teams, then directing the employee to install a fake "PowerShell Cleaner" tool — an .MSI installer hosted on Microsoft Azure, which lends it false credibility since the download comes from a Microsoft-owned domain. That installer unpacks a Python-based framework, PowerShell scripts, and fake Microsoft runtime files that quietly deploy SynkLoader's real payload: a set of modules for system profiling, persistence, remote shell access, VNC-style remote control, and a fake Windows lock screen used to phish the victim's own login password.

That last piece, dubbed PhishLocker, is the part worth understanding, because it shows exactly how thin the line is between "convincing" and "real":

"Simply using Alt+Tab exposes the active windows on top of the lock screen which is just a full-screen borderless GUI application."
— BleepingComputer

In other words: the fake lock screen is a window, not the OS. It looks right until someone tests it. But most people don't test their lock screen — they type their password and move on. Once SynkLoader has it, other modules gather the hostname, username, privilege level, running processes and services, and a count of machines on the Active Directory domain — reconnaissance that reads like the early stage of a ransomware intrusion, not a one-off credential grab.

A concrete example

Picture a 30-person fintech startup where engineering and support both live in Microsoft Teams all day. A message lands from "IT Helpdesk," matching the company's real naming convention closely enough not to raise an eyebrow, asking the on-call support engineer to run a "PowerShell Cleaner" before a scheduled maintenance window. The engineer, wanting to be responsive, clicks through. The installer runs, a lock screen appears asking for their Windows password "to finish applying the update," and they type it in. Nothing looks broken afterward — which is the point. The attacker now has a domain-joined credential and a headcount of every machine on the network, and nobody at the company knows to look.

What to actually do about it

• Set a rule: IT support requests never arrive as a cold Teams DM. If your team is small enough not to have a formal help desk, say so explicitly — "we will never ask you to install something over chat" is a one-sentence policy that kills this lure.
• Restrict who can message your org from outside it. Microsoft Teams external access settings control whether accounts outside your tenant can DM your employees at all — most small companies leave this wide open by default and never revisit it.
• Treat any unexpected installer as hostile, even from a Microsoft-hosted link. This campaign specifically uses Azure-hosted files to look legitimate — "it's on Microsoft's domain" is not a safety check.
• Tell people the lock-screen trick, out loud. A one-line heads-up — "if your screen locks unexpectedly and asks for your password, hit Alt+Tab before typing anything" — turns your whole team into a detection layer for exactly this technique.
• Know what's actually exposed on your domain before an attacker profiles it for you. SynkLoader's reconnaissance modules are built to map an Active Directory environment fast; the same public footprint an attacker checks first is worth checking yourself.

If you don't know what your company looks like from the outside — what an attacker sees before they ever send the first Teams message — that's exactly what OrangeStealth's External Security Posture Assessment is for: a passive, external-only look at your exposure, with no agents to install and nothing to disrupt.