SynkLoader Malware Targets Corporate Networks with Password Theft and Remote Access
A newly identified malware strain, SynkLoader, is being deployed via phishing attacks on Microsoft Teams, with threat actors masquerading as IT support to trick users into installing a counterfeit PowerShell Cleaner tool hosted on Microsoft Azure.
Analysis of the Malware
Analysis of the malware revealed it was first distributed around July 28, 2026, and employs a multi-layered approach to gain unauthorized access and maintain persistence within compromised networks.
Initial Payload and Components
The initial payload includes a PowerShell script named cleaner.ps1, alongside a ZIP archive containing a Python framework, a malicious Python script, precompiled Python libraries, and fabricated Microsoft runtime DLLs. This combination allows the malware to operate across multiple programming environments, leveraging Python, PowerShell, C#, and C++ to adapt to different system configurations.
Data Collection and Persistence
Researchers observed that the malware dynamically selects components based on the target’s infrastructure, enabling it to execute a range of malicious activities. One critical module within SynkLoader is designed to gather system information, including the hostname, username, privilege level, active processes, services, domain details, and the structure of Active Directory. This data collection phase helps attackers map network environments, potentially paving the way for broader exploitation. A persistence mechanism creates a randomly named scheduled task that triggers SynkLoader upon user login and daily at 10 a.m., ensuring long-term access.
Remote Access and Traffic Redirection
The malware also includes remote access capabilities, allowing attackers to execute PowerShell commands, stream desktop activity, and control a victim’s session remotely. A traffic redirection component functions as a reverse proxy, enabling threat actors to access internal network resources or route internet traffic through the compromised machine.
Reporting and PhishLocker Module
Additionally, a reporting module tracks active SynkLoader components and their associated processes, providing attackers with real-time visibility into the infection. A notable feature of SynkLoader is the PhishLocker module, which presents users with a lifelike fake Windows lock screen to steal credentials. This interface, however, is a borderless application rather than a genuine authentication prompt.
Investigation and Detection Challenges
Investigations into the campaign revealed that attackers attempted to profile a honeypot system mimicking a legitimate target. After detecting the setup, the threat actor terminated the connection, suggesting a focus on high-value objectives. Researchers highlighted that SynkLoader’s modular design and use of unique module hashes for each infection complicate detection efforts, as traditional hash-based methods prove ineffective.
User and Organizational Advice
Users are advised to scrutinize unexpected IT-related requests, particularly those received through Microsoft Teams. Avoid installing unsolicited MSI files, and verify the legitimacy of any system prompts. If encountering an unfamiliar lock screen, users should attempt to press Ctrl+Alt+Delete or Alt+Tab to confirm its authenticity. Organizations are encouraged to monitor for unusual network activity and implement strict verification protocols for support communications.
Conclusion
The campaign underscores the evolving tactics of cybercriminals, who increasingly exploit trusted collaboration platforms and cloud services to deploy sophisticated malware. As SynkLoader demonstrates, the integration of multiple programming languages and advanced persistence techniques poses significant challenges for defenders. Continued vigilance and proactive security measures remain critical to mitigating such threats.
About Author
English