SynkLoader Uses Fake Windows Lock Screen to Steal Passwords via Teams
An ordinary-looking message from corporate IT support on Microsoft Teams can end in a stolen Windows password and full access to a company’s internal network. Researchers at Expel discovered a new malware family called SynkLoader, which disguises a credential-stealing window as a genuine Windows lock screen.
Initial Access: Fake IT Support on Microsoft Teams
Attackers contact an employee through Microsoft Teams under the guise of an “IT Service Desk” identity, persuading the target to install what’s presented as a PowerShell cleanup utility. The installer, an MSI file, is hosted on Microsoft Azure storage, lending the malicious link an added layer of credibility. Inside the package sit a PowerShell script, a bundled Python environment, and the core SynkLoader components. Based on file timestamps, the first samples of the malware appeared around July 28, 2026.
An Unusually Complex, Multi-Language Architecture
SynkLoader stands out for its unusually elaborate architecture. Its developers blended Python, PowerShell, C#, and C++ together, with individual modules relying on multiple languages simultaneously. Portions of the code operate entirely in memory, leaving fewer traces on disk and making detection considerably harder for security tools. The primary loader contacts one of three command-and-control servers every 90 to 120 seconds and can execute Python code delivered directly by its operators.
Reconnaissance and Persistence
Once it infects a machine, SynkLoader collects the computer name, username, privilege level, running processes, active services, and domain information, and even enumerates the number of computers present within Active Directory. To maintain persistence, the malware creates a randomly named scheduled task that runs at user login and again daily at 10 a.m.
PhishLocker: A Convincing Fake Windows 11 Lock Screen
The most striking component is PhishLocker. This module opens a full-screen window that nearly perfectly replicates the Windows 11 lock screen, including the username, background image, and password field. Any credentials entered are captured and sent directly to the attacker. Notably, the module never actually validates the entered password against anything real, meaning the fake screen can be dismissed simply by typing arbitrary characters. Users can also identify the deception via Alt+Tab, since what’s actually displayed is just an ordinary full-screen application rather than a genuine system lock state.
TrafficRedirector: Turning Victims Into Proxy Nodes
The stolen password is complemented by a module called TrafficRedirector, which transforms the infected computer into an intermediary relay node. Through it, operators can reach internal corporate resources and external services using the victim’s own IP address. This approach helps bypass IP-based restrictions and reduces the likelihood of triggering alerts for logins originating from an unusual country or network.
Additional Capabilities: Remote Command Execution and Desktop Control
The toolkit also includes a remote PowerShell command execution utility and a module called StreamMaster, which allows operators to view the victim’s desktop and control the mouse and keyboard directly. Expel managed to obtain these components after researchers successfully replicated SynkLoader’s communication protocol and presented a test system as a machine belonging to a large corporate network. Roughly 12 hours later, the operators manually connected to the decoy and began deploying additional tools.
The Campaign’s Ultimate Goal Remains Unclear
The campaign’s ultimate objective could not be conclusively established. However, SynkLoader deliberately enumerates the number of computers within Active Directory – and the overall size of a corporate network is a detail ransomware operators frequently take a keen interest in. Expel assesses, with low to medium confidence, that the toolkit may belong to a ransomware group or to a broker specializing in gaining initial network access and subsequently selling it to other threat actors.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
