SynkLoader: New Malware Uses Microsoft Teams Phishing to Target Windows Networks
SynkLoader: New Malware Uses Microsoft Teams Phishing to Target Windows Networks
A new malware family is being distributed through Microsoft Teams phishing campaigns, using fake IT support messages to convince employees to install a malicious Windows package.
The malware, tracked as SynkLoader, combines several components written in Python, PowerShell, C# and C++. Researchers say it can steal credentials, collect information about compromised environments and provide attackers with remote access capabilities. The activity was first observed around July 28, 2026.
This campaign is particularly interesting because it does not rely on the traditional phishing-email model. Instead, attackers exploit something employees are generally trained to trust: a message apparently coming from the company’s IT department inside Microsoft Teams.
The attack begins with fake IT support
The attackers impersonate an organization’s IT help desk and contact employees through Microsoft Teams.
The message typically claims that the user needs to perform some kind of technical maintenance.
The victim is then instructed to download a supposedly legitimate utility called PowerShell Cleaner.
The file is distributed as an MSI installer and is hosted on Microsoft Azure, which can make the download appear more trustworthy to the victim.
This is an important element of the campaign.
The attacker is not simply sending an obviously suspicious executable.
Instead, the entire scenario is constructed around a believable story:
IT support → technical problem → security utility → software installation
That social-engineering approach can be considerably more effective than a conventional phishing email.
Security researchers have previously warned that attackers increasingly abuse Microsoft Teams for exactly this type of impersonation and social engineering.
Why Microsoft Teams is becoming a phishing target
Employees have become accustomed to treating email links and attachments with suspicion.
Teams messages can feel different.
A message arriving inside the company’s collaboration platform may appear more legitimate, particularly when the sender claims to be an administrator or help-desk employee.
This creates a psychological advantage for attackers.
The victim may think:
„This is an internal IT issue, so I should follow the instructions.”
The problem is that Microsoft Teams can also receive communications from external organizations, and attackers can exploit permissive external communication settings.
Palo Alto Networks has previously documented campaigns in which threat actors contacted employees through Teams while impersonating trusted organizations, vendors or internal support personnel.
The fake PowerShell Cleaner
The malicious installer is disguised as a legitimate maintenance tool.
Once the victim launches the MSI package, it extracts several components, including:
- a PowerShell script,
- a ZIP archive,
- Python components,
- malicious Python code,
- precompiled libraries,
- fake Microsoft runtime DLLs.
The use of multiple programming languages makes the malware particularly interesting from an analysis perspective.
Instead of relying on a single executable, SynkLoader uses a combination of Python, PowerShell, C# and C++ components.
This also demonstrates how modern malware increasingly resembles a collection of specialized modules rather than one monolithic program.
What can SynkLoader do?
According to researchers, the malware can deploy different modules depending on the environment it encounters.
Its capabilities include functionality for:
- credential theft,
- system reconnaissance,
- remote command execution,
- PowerShell access,
- reverse proxying,
- remote desktop functionality,
- network tunneling,
- collection of information about the compromised environment.
The attackers can therefore use the initial infection as a foothold and then decide what functionality is needed for the particular victim.
This modular approach is particularly dangerous in corporate environments.
An attacker does not necessarily need to deploy every capability immediately.
They can first determine what kind of system has been compromised and then activate additional functionality.
SynkLoader looks for Active Directory information
One of the more concerning aspects of the campaign is its interest in the victim’s Active Directory environment.
For an attacker, understanding the structure of an organization’s identity infrastructure can be extremely valuable.
Active Directory can reveal information about:
- users,
- computers,
- groups,
- organizational structure,
- domain relationships,
- privileged accounts.
That information can help attackers determine where they are inside a network and identify potentially valuable targets.
This makes SynkLoader more than a simple credential-stealing malware sample.
It can potentially become the first stage of a broader intrusion.
From Teams phishing to ransomware
Researchers have warned that the observed activity may ultimately be connected to ransomware operations.
This is an important distinction.
The initial infection itself may not encrypt files or display a ransom note.
Instead, malware such as SynkLoader can provide initial access and reconnaissance, after which attackers can deploy additional tools.
A possible attack chain could therefore look like:
Teams phishing
↓
Fake IT support
↓
Malicious MSI
↓
SynkLoader
↓
Credential theft
↓
Active Directory reconnaissance
↓
Lateral movement
↓
Privilege escalation
↓
Ransomware or data theft
This type of multi-stage attack is increasingly common.
The malware installed during the first stage does not necessarily represent the final objective.
Why MSI files are dangerous in social engineering
MSI installers have a legitimate role in Windows environments.
Organizations use them to distribute applications and software updates.
That makes the file format useful for attackers attempting to disguise malware as legitimate corporate software.
An employee may be less suspicious of:
PowerShell Cleaner.msi
than an obviously malicious executable with a random filename.
The filename alone, of course, proves nothing.
A malicious MSI can contain scripts and additional components capable of launching other processes.
For administrators, this is another reason why software installation should not depend solely on the employee recognizing suspicious filenames.
Azure hosting does not make a file trustworthy
Another interesting part of this campaign is the use of Microsoft Azure to host the malicious installer.
This demonstrates an important security principle:
A file hosted on a legitimate cloud platform is not automatically legitimate.
Attackers can abuse reputable infrastructure providers because their services offer reliability and can make malicious infrastructure appear less suspicious.
Security teams therefore need to evaluate the complete context of a download rather than simply asking:
„Is this file hosted on Microsoft infrastructure?”
The more important question is:
„Was this file expected, authorized and verified?”
How organizations can reduce the risk
The first line of defense against this campaign is not necessarily a new security product.
It is verification.
Employees should never install software simply because somebody contacted them through Teams and claimed to be from IT.
A legitimate support request should be verified through an established internal process.
Restrict external Teams communication
Organizations that do not require unrestricted external Teams communication should review their configuration.
Reducing unnecessary external communication can remove an entire attack vector.
Palo Alto Networks specifically recommends tightening Teams external-access policies where business requirements allow it.
Control software installation
Employees should not have unrestricted ability to install arbitrary applications.
Application control policies can significantly reduce the effectiveness of socially engineered MSI installers.
Monitor PowerShell
PowerShell is an extremely useful administrative technology, but it is also frequently abused by attackers.
Organizations should monitor suspicious PowerShell execution, especially when it originates from unusual applications or user directories.
Use application control
Technologies such as WDAC and other application-control mechanisms can restrict which binaries and scripts are permitted to execute.
This can provide an additional layer of protection if a user is successfully tricked into downloading malware.
Train employees for Teams phishing
Traditional security awareness training often focuses heavily on email.
That is no longer enough.
Employees should also be trained to recognize:
- fake IT support requests,
- unexpected Teams messages,
- requests to install software,
- requests for remote access,
- suspicious external accounts,
- urgent security instructions.
The human element remains the biggest weakness
SynkLoader demonstrates something important about modern attacks.
The malware itself is only part of the equation.
The attacker first needs the victim to believe a story.
In this case, that story is:
„I’m from IT and I’m here to fix your computer.”
The attacker then provides a plausible-looking application and a reason why it needs to be installed.
Technically sophisticated malware can therefore enter an organization through a very simple mechanism:
trust.
This is why security awareness remains important even in organizations with modern endpoint protection.
Final Thoughts
The SynkLoader campaign shows how phishing is moving beyond email.
Microsoft Teams is increasingly becoming an attractive target because employees naturally trust collaboration platforms and may be more willing to follow instructions received from someone claiming to be IT support.
The combination of a fake PowerShell Cleaner, malicious MSI installation, multiple programming languages, credential theft and Active Directory reconnaissance makes this campaign particularly relevant for Windows administrators and security teams.
The biggest lesson is simple:
Never install software merely because someone claiming to be IT support tells you to do it through Teams.
A legitimate help-desk request should be independently verified before any software is installed or remote access is granted.
For organizations, the best defense is a combination of strong identity controls, restricted Teams external access, application control, PowerShell monitoring, endpoint protection and employee awareness.
The attack surface is no longer limited to email and web browsers. In modern corporate environments, every trusted communication channel can become a phishing channel.
AI miało sterować Androidem. Problem w tym, że haker też może – krytyczna luka w Microsoft UFO Sztuczna inteligencja coraz Czytaj dalej
Adobe Campaign Classic Vulnerability Rated CVSS 10.0 Allows Remote Code Execution Adobe has released security updates for Adobe Campaign Classic Czytaj dalej
