Expel has discovered SynkLoader, a new modular malware family that exploits Microsoft Teams phishing to compromise corporate networks. The campaign, active since approximately July 28, 2026, impersonates the victim's IT help desk to lure them into installing a fake "PowerShell Cleaner" hosted on Microsoft Azure. The malware combines Python, PowerShell, C#, and C++ in a memory-resident infection chain that evades traditional signatures.
- SynkLoader spreads via Microsoft Teams phishing campaigns in which attackers impersonate the victim's IT help desk.
- The MSI installer extracts a PowerShell script and an embedded Python framework that loads C# modules from counterfeit DLLs, with a multi-language chain spanning up to three languages per single module.
- The malware includes modules for system profiling, persistence, credential theft via a fake lock screen (bypassable with Alt+Tab), reverse proxy tunneling, and VNC remote desktop control.
- Developer metadata was not stripped: the PDB path contains the username "genry," making the malware identifiable despite its ostentatious complexity.
How the Social Engineering Works on Teams
The attack chain begins with a contact on Microsoft Teams. According to Expel, the attackers use an @company.onmicrosoft.com email address with the display name "IT Service Desk." The conversation convinces the user to download and install an MSI file named "PowerShell Cleaner" from a Microsoft Azure file storage endpoint. The use of legitimate Microsoft infrastructure lends the download an air of authenticity that bypasses URL reputation-based defenses.
Once executed, the MSI installer extracts two main components: a PowerShell script (cleaner.ps1) and a ZIP archive containing the Python framework, malicious scripts, precompiled libraries, and counterfeit Microsoft runtime DLLs. The main loader (ss.py) establishes communication with one of three hardcoded C2 domains: neversoftmain[.]net, rootfarmapp[.]net, tripinupdate[.]net. Requests are encrypted with a modified ChaCha20, using the victim ID — corresponding to a random 16-character installation directory — as the key.
The interval between C2 requests varies randomly between 90 and 120 seconds. This temporal jitter, combined with the use of seemingly neutral cloud infrastructure, makes the traffic difficult to distinguish from legitimate communications for detection systems relying on static thresholds.
Multi-Language Complexity as a Double-Edged Sword
SynkLoader owes its name to an "everything but the kitchen sink" approach: Expel researcher Marcus Hutchins documented how individual modules interweave up to three programming languages simultaneously. The Python loader extracts and loads C# modules from fake DLLs (msvcp150.dll), which in turn execute PowerShell in-memory via dynamic ScriptBlock and IEX (Invoke-Expression). This layering hides indicators of compromise from static scanning but introduces operational fragility.
The linguistic fragmentation indeed generates a larger detection surface than the attacker apparently assumes. The original PDB path — C:\Users\genry\source\repos\pwshnewdll\x64\Release\pwshnewdll.pdb — remained in the DLL metadata, exposing the identifier "genry" as a possible developer name. Compilation timestamps indicate initial deployment around July 28, 2026, with the msvcp150.dll dated at 08:02:11 that same day. The presence of these artifacts suggests the rush for complexity sacrificed the most basic operational security.
"We decided on the name SynkLoader (pronounced 'Sink Loader'), in reference to its 'everything but the kitchen sink' approach." — Expel (Marcus Hutchins)
Functional Modules: From Profiling to Remote Control
SynkLoader operates entirely in memory after the initial stage, without traditional on-disk persistence for its core components. The "System Profiler" module gathers hostname, username, user privileges, active processes, services, domain details, and the number of computers in Active Directory. According to Hutchins, this last data point points toward a likely ransomware or initial access brokering objective, though the dossier does not document independent confirmation of such use.
The "PhishLocker" module implements credential theft through a fake Windows lock screen. Expel verified this is a borderless fullscreen GUI application, not a genuine OS lock screen: pressing Alt+Tab or Ctrl+Alt+Delete immediately exposes the window's artificial nature. The "TrafficRedirector" module establishes a reverse proxy to reach internal network services or route traffic through the compromised host. The "Interactive Shell" module enables remote PowerShell command execution, while "StreamMaster" provides VNC functionality for remote desktop control.
Expel emulated the reverse shell module, confirming these are "hands-on-keyboard" attacks with an active human operator. During interaction with the emulator, the attacker attempted profiling commands before realizing the environment was fake and disconnecting. This observation rules out SynkLoader operating as a fully automated bot: human presence implies real-time adaptation and decision-making capabilities.
What to Do Now
- Verify that Teams policies restrict external contacts or flag them visually, since the primary vector exploits the apparent legitimacy of @company.onmicrosoft.com accounts.
- Test MSI installer approval processes even when hosted on your own cloud infrastructure: hosting reputation does not guarantee payload integrity.
- Review EDR detection criteria to include Python execution from temporary paths and dynamic DLL loading from ZIP archives extracted by installers.
- Inform users that a genuine Windows lock screen cannot be bypassed with Alt+Tab: this check takes seconds and neutralizes the PhishLocker module.
Why Flaunted Complexity Doesn't Pay
The paradox of SynkLoader lies in the discrepancy between ambition and execution. The malware aims to evade defenses through indirection and layering, but this very complexity generates recognizable artifacts: PDB metadata, consistent timestamps, hardcoded C2 domains. Expel's emulation of the C2 protocol demonstrated that technical sophistication does not equal operational robustness when the attacker neglects fundamental hygiene.
For enterprise defenses, the lesson is twofold. The Teams vector exploits implicit trust in the Microsoft ecosystem: traditional perimeter barriers based on URL reputation lose effectiveness when phishing transits legitimate enterprise channels. At the same time, Hutchins' analysis suggests that "polyglot" and memory-resident loaders require a redesign of EDR tools, which must track orchestration across heterogeneous processes rather than static signatures of individual files.
The identity of the developer "genry" remains unknown: it could be a pseudonym, real name, or system account. No infrastructure overlaps link the operator to known threat actor groups at the current state of the dossier. The exact number of victims and the campaign's geographic coverage are not documented.
Sources
- https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/
- https://radar.offseq.com/threat/synkloader-when-you-throw-in-everything-but-the-kitchen-sink-3503834114e296c8
- https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/
- https://www.bleepingcomputer.com/
- https://www.bleepingcomputer.com/tutorials/
- https://www.bleepingcomputer.com/download/
- https://deals.bleepingcomputer.com/
Information has been verified against cited sources and updated at time of publication.