--- title: SynkLoader: A New Multitool Malware Spreading Through... description: A newly discovered malware kit called SynkLoader combines phishing via fake IT help desk Microsoft Teams messages, in-memory PowerShell, a stripped-down Python... canonical: https://daily.dev/posts/synkloader-a-new-multitool-malware-spreading-through-fake-it-help-desk-chats-l3diyiokn twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SynkLoader: A New Multitool Malware Spreading Through Fake IT Help Desk Chats | daily.dev og:description: A newly discovered malware kit called SynkLoader combines phishing via fake IT help desk Microsoft Teams messages, in-memory PowerShell, a stripped-down Python... og:url: https://daily.dev/posts/synkloader-a-new-multitool-malware-spreading-through-fake-it-help-desk-chats-l3diyiokn og:image: https://api.daily.dev/og/posts/l3dIYIOKN.png og:image:alt: SynkLoader: A New Multitool Malware Spreading Through Fake IT Help Desk Chats og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SynkLoader: A New Multitool Malware Spreading Through Fake IT Help Desk Chats **[Collections](https://daily.dev/sources/collections)** · 3 min read · 0 upvotes · 0 comments ## Summary A newly discovered malware kit called SynkLoader combines phishing via fake IT help desk Microsoft Teams messages, in-memory PowerShell, a stripped-down Python environment, and COM hijacking for persistence to evade EDR detection. It bundles a RAT, reverse proxy, VNC-style remote access, and an Active Directory profiler that measures network size, suggesting the operators are building access to sell or hold for ransom rather than pursuing espionage. Its standout module, PhishLocker, mimics the Windows lock screen to steal credentials, which is especially dangerous in SSO environments, though pressing Alt+Tab or Ctrl+Alt+Delete reveals the fake and defeats it. First deployed around July 28 and caught in a client network on August 18 via researchers at Expel with help from Marcus Hutchins. ## Content There's a new malware kit going around, and it's a genuinely creative piece of criminal engineering. Researchers at Expel — with help from Marcus Hutchins — found it through a honeypot and named it SynkLoader. What stands out isn't any single trick, it's how many different techniques got bolted together into one package. ## How it gets in The attack starts with a phishing message impersonating an IT help desk, sent through Microsoft Teams from a self-registered Microsoft 365 tenant. Victims are told to install a "PowerShell Cleaner" MSI file hosted on Azure. It's the kind of thing that sounds plausible enough in a corporate chat window to get clicked. Once installed, SynkLoader runs PowerShell entirely in memory and pairs it with a stripped-down Python environment that talks to native DLLs. For persistence, it uses COM hijacking rather than more common registry or scheduled-task methods, which helps it slip past EDR tools that are tuned to look for the usual suspects. ## What's inside The toolkit bundles several modules: - A RAT for remote control - A reverse proxy, used for lateral movement across a network - VNC-style desktop takeover - A system profiler that quietly measures the size of the Active Directory environment it's landed in That last one is the tell. Legitimate malware doesn't usually care how big your network is — but ransomware crews and initial access brokers do. Bigger network, bigger payday. Researchers see this profiling behavior as a strong signal that SynkLoader isn't the work of a nation-state APT chasing espionage, but rather someone building access to sell or ransom. ## PhishLocker: the interesting part The most novel piece is a module called PhishLocker. It throws up a DLL that mimics the Windows lock screen convincingly enough to trick victims into typing their password directly into the attacker's hands. This is an old trick — fake lock screens go back years — but it's rarely seen deployed this cleanly in a modern toolkit. In an SSO environment, this is worse than it sounds. Steal one password this way and you don't just get one account — you potentially get the keys to everything that account touches. One convincing fake screen, and suddenly the attacker has a foothold across the whole company. The good news: it's beatable with basic muscle memory. Pressing Alt+Tab or Ctrl+Alt+Delete will break the illusion, since a real Windows lock screen behaves differently than a DLL faking one. Worth teaching your users this, honestly — it's a five-second habit that defeats a fairly clever piece of malware. ## Timeline SynkLoader was first deployed around July 28 and turned up in a client network on August 18, caught via the Teams phishing campaign described above. Given the network-profiling behavior and the ransomware-adjacent toolkit, I'd treat this as a precursor worth watching — the kind of thing that shows up weeks before the actual ransomware note does. ## Questions this post answers ### How can I tell if a Windows lock screen is fake during a phishing attack? Press Alt+Tab or Ctrl+Alt+Delete; a real Windows lock screen responds differently than a fake one rendered by a malicious DLL, which breaks the illusion immediately. This defense works against the PhishLocker module used by the SynkLoader malware kit, which mimics the lock screen to steal passwords directly, particularly dangerous in SSO environments. _daily.dev keeps security teams current on emerging credential-theft techniques like fake lock screen phishing._ ### What is SynkLoader malware and how does it spread? SynkLoader is a multitool malware kit spread through phishing messages impersonating IT help desks, sent via Microsoft Teams from self-registered Microsoft 365 tenants, tricking victims into installing a fake PowerShell Cleaner MSI hosted on Azure. It runs PowerShell in memory, uses a stripped-down Python environment, and persists via COM hijacking to evade EDR tools, and was first deployed around July 28. _Track emerging phishing and malware campaigns like this on daily.dev before they hit your network._ ### Why would malware profile the size of an Active Directory environment? Measuring Active Directory size signals that operators are assessing network value before selling access or deploying ransomware, since bigger networks mean bigger payouts for initial access brokers and ransomware crews. Researchers point to this profiling behavior in SynkLoader as evidence it is financially motivated rather than nation-state espionage tooling. _Security teams evaluating ransomware precursors can follow threat research like this on daily.dev._ ## Similar posts on daily.dev - [CountLoader Broadens Russian Ransomware Operations With Multi-Version Malware Loader](https://daily.dev/posts/countloader-broadens-russian-ransomware-operations-with-multi-version-malware-loader-df0hp16ec) · The Hacker News · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#malware](https://daily.dev/tags/malware), [#ransomware](https://daily.dev/tags/ransomware), [#phishing](https://daily.dev/tags/phishing) [View this post on daily.dev](https://daily.dev/posts/synkloader-a-new-multitool-malware-spreading-through-fake-it-help-desk-chats-l3diyiokn) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SynkLoader: A New Multitool Malware Spreading Through Fake IT Help Desk Chats","url":"https://daily.dev/posts/synkloader-a-new-multitool-malware-spreading-through-fake-it-help-desk-chats-l3diyiokn","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/synkloader-a-new-multitool-malware-spreading-through-fake-it-help-desk-chats-l3diyiokn"},"datePublished":"2026-08-24T15:49:06.508Z","dateModified":"2026-08-24T15:49:52.153Z","description":"A newly discovered malware kit called SynkLoader combines phishing via fake IT help desk Microsoft Teams messages, in-memory PowerShell, a stripped-down Python...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9075444dfa0933932b1b79d21f3382f7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/9075444dfa0933932b1b79d21f3382f7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Collections","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Collections","logo":"https://media.daily.dev/image/upload/s--fk_6ycEi--/f_auto,q_auto/v1780996001/logos/collections?_a=BAMAMiWQ0","url":"https://daily.dev/sources/collections"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/synkloader-a-new-multitool-malware-spreading-through-fake-it-help-desk-chats-l3diyiokn","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,malware,ransomware,phishing","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Collections","item":"https://daily.dev/sources/collections"},{"@type":"ListItem","position":3,"name":"SynkLoader: A New Multitool Malware Spreading Through Fake IT Help Desk Chats"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/synkloader-a-new-multitool-malware-spreading-through-fake-it-help-desk-chats-l3diyiokn#faq","mainEntity":[{"@type":"Question","name":"How can I tell if a Windows lock screen is fake during a phishing attack?","acceptedAnswer":{"@type":"Answer","text":"Press Alt+Tab or Ctrl+Alt+Delete; a real Windows lock screen responds differently than a fake one rendered by a malicious DLL, which breaks the illusion immediately. This defense works against the PhishLocker module used by the SynkLoader malware kit, which mimics the lock screen to steal passwords directly, particularly dangerous in SSO environments. daily.dev keeps security teams current on emerging credential-theft techniques like fake lock screen phishing."}},{"@type":"Question","name":"What is SynkLoader malware and how does it spread?","acceptedAnswer":{"@type":"Answer","text":"SynkLoader is a multitool malware kit spread through phishing messages impersonating IT help desks, sent via Microsoft Teams from self-registered Microsoft 365 tenants, tricking victims into installing a fake PowerShell Cleaner MSI hosted on Azure. It runs PowerShell in memory, uses a stripped-down Python environment, and persists via COM hijacking to evade EDR tools, and was first deployed around July 28. Track emerging phishing and malware campaigns like this on daily.dev before they hit your network."}},{"@type":"Question","name":"Why would malware profile the size of an Active Directory environment?","acceptedAnswer":{"@type":"Answer","text":"Measuring Active Directory size signals that operators are assessing network value before selling access or deploying ransomware, since bigger networks mean bigger payouts for initial access brokers and ransomware crews. Researchers point to this profiling behavior in SynkLoader as evidence it is financially motivated rather than nation-state espionage tooling. Security teams evaluating ransomware precursors can follow threat research like this on daily.dev."}}]} ```