A newly identified malware family called SynkLoader is being spread through Microsoft Teams phishing campaigns that impersonate IT help desks. Victims are tricked into installing a fake 'PowerShell Cleaner' MSI hosted on Azure, which deploys modules including a fake Windows lock screen (PhishLocker) to steal passwords, a reverse proxy for network access, a remote shell, and VNC-style desktop control. Researchers at Expel, who discovered the malware via a honeypot, believe it is likely used in ransomware operations due to its focus on profiling Active Directory environment size. The fake lock screen can be detected using Alt+Tab or Ctrl+Alt+Delete.
Questions this post answers
What is SynkLoader malware and how does it steal Windows passwords?
SynkLoader is a malware family distributed via Microsoft Teams phishing campaigns impersonating IT help desks, first compiled and distributed around July 28, 2026. It tricks victims into installing a fake 'PowerShell Cleaner' MSI hosted on Azure, which deploys a PhishLocker module displaying a convincing fake Windows lock screen to capture the victim's login password. Security teams tracking new social-engineering malware tactics can follow research like this on daily.dev.
How can I tell if a Windows lock screen is fake and part of a phishing attack?
A fake lock screen used by malware like PhishLocker is just a full-screen borderless GUI application overlaying the real desktop, so pressing Alt+Tab exposes the active windows underneath it, revealing the deception. Ctrl+Alt+Delete is another reliable way to check whether an unexpected lock screen is genuine. Developers and IT staff verifying suspicious lock screens can track defensive tips like this on daily.dev.
What malware modules does SynkLoader use to compromise a corporate network after initial infection?
SynkLoader includes seven modules: a System Profiler that gathers host, user, and Active Directory details; a Persistence Module using scheduled tasks; PhishLocker for credential theft via a fake lock screen; a TrafficRedirector reverse proxy; an interactive PowerShell RAT shell; a StreamMaster VNC-style remote desktop tool; and a Module Status Script reporting active threads. Incident responders mapping out attacker tooling can follow breakdowns like this on daily.dev.