SynkLoader Malware Spreads Through Microsoft Teams Phishing Attacks

A previously unknown malware loader dubbed SynkLoader has been spreading through Microsoft Teams phishing attacks. The malware, which combines Python, C#, and native C++ components to evade detection, was first spotted on August 18, 2026.

The infection began with a Microsoft Teams message from an attacker posing as “IT Service Desk,” using a spoofed @company.onmicrosoft.com address to appear legitimate. The impersonator convinced the target to download an MSI installer, disguised as a “PowerShell Cleaner,” from an Azure Blob Storage URL.

Once executed, the MSI drops a PowerShell script that runs entirely in memory, decrypting an AES-CBC payload before deploying a full embedded Python environment. The core loader script beacons to one of several C2 domains using a modified ChaCha20 cipher.

The malware's real trick is layering languages to dodge behavioral detection: Python calls fake Microsoft runtime DLLs that are actually custom C# and C++ modules capable of running PowerShell in memory. After profiling the host, the malware deploys its most novel component: PhishLocker, a full-screen GUI that mimics the Windows 11 lock screen to harvest login credentials directly.