SynkLoader Malware Targets Microsoft Teams Users with Fake Lock Screen

A new malware family called SynkLoader has been discovered in Microsoft Teams phishing campaigns. The attackers impersonate the target company's IT help desk, a tactic highlighted by Microsoft earlier this year as increasingly common in multi-stage attacks.

Expel's security researcher Marcus Hutchins explained that the attacks direct the victim to install a fake 'PowerShell Cleaner' executable (.MSI) hosted in Microsoft Azure. The download appears trustworthy due to its hosting on Azure.

The analysis of the malware showed compile dates and file timestamps indicating it was first compiled and distributed around July 28, 2026.