Microsoft Teams Used for Phishing Attacks to Deliver New SynkLoader Malware

Microsoft Teams has been used as a phishing platform to deliver new malware called SynkLoader. The attackers pose as IT helpdesk workers and trick employees into installing what appears to be a useful fix.

The SynkLoader toolkit is a layered malware that hides its activity in memory, gathers system information, and maintains a channel back to the operators. This gives Teams chats the potential to become serious corporate network intrusions.

Analysts at Expel identified the malware during an investigation and found that it was first built and distributed around July 28, 2026.

The toolkit also installs a fake lock screen that resembles the Windows lock screen, which retrieves the current username and password. This is a concerning add-on as it can collect raw Windows passwords, giving operators access to internal services with legitimate-looking credentials.