Expel security researcher Marcus Hutchins has published an analysis of SynkLoader, a previously unknown modular malware family first compiled around July 28, 2026, and already appearing in live attacks. The campaign works as follows: attackers impersonate a target company’s IT help desk via Microsoft Teams, directing victims to install a fake “PowerShell Cleaner” executable (.MSI) hosted on Microsoft Azure infrastructure, lending the download a veneer of legitimacy. The installer silently unpacks a Python runtime, a malicious Python script, and several fake Microsoft DLL files alongside a PowerShell script called cleaner.ps1.
What makes SynkLoader unusual is its modular architecture and its use of up to three programming languages — Python, PowerShell, C#, and C++ — in a single module, complicating analysis. The most dangerous component is PhishLocker: it throws up a convincing full-screen fake Windows lock screen and waits for the victim to type their password. With that credential in hand, attackers use a built-in tunneling module to connect back into the corporate network from the infected machine, bypassing IP allow-list restrictions that would otherwise block external logins. Expel assessed SynkLoader is likely a ransomware precursor tool, noting its focus on measuring Active Directory environment size — a common reconnaissance step before deploying ransomware. The fake lock screen can be defeated by pressing Alt+Tab, which reveals the real desktop beneath the full-screen overlay.
How to check if you’re affected
Affected products include Microsoft Teams on Windows in any corporate environment. If anyone in your organization has received an unsolicited Teams message from a person claiming to be IT support — especially one requesting software installation — treat it as a potential SynkLoader delivery attempt:
- Never install software (especially MSI or EXE files) based solely on a Teams message, even if the sender appears to be from your IT department.
- Always verify IT requests through a secondary channel (phone call, ticketing system) before installing anything.
- If you see an unexpected lock screen, press Alt+Tab or Ctrl+Alt+Delete to check whether it is a real Windows screen.
- Review your environment for Expel’s published indicators of compromise (see source below), particularly Azure-hosted MSI downloads and outbound tunneling connections.