CTI · corroborated · 2026-08-24

SynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows Passwords

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1053 Scheduled Task/Job Execution
• T1027 Obfuscated Files or Information Stealth
• T1036 Masquerading Stealth
• T1056 Input Capture Collection

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• company.onmicrosoft.com domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: SynkLoader PowerShell Cleaner Payload Execution
id: 2b8c4d5e-6f7a-8b9c-0d1e-2f3a4b5c6d7e
status: experimental
description: >
    Detects execution of the SynkLoader malware delivered via Microsoft
    Teams phishing. The attack chain starts with an MSI installer
    disguised as "PowerShell Cleaner" that drops cleaner.ps1, which
    executes entirely in memory via nested Invoke-Expression and
    ScriptBlock::Create calls. The PowerShell script decrypts an
    AES-CBC payload and deploys a Python environment to %AppData%,
    then beacons to C2 domains (neversoftmain[.]net, rootfarmapp[.]net).
references:
    - https://www.bleepingcomputer.com/news/security/new-synkloader-malware-uses-fake-windows-lock-screen-to-steal-passwords/
author: Tia N. List
date: 2026/08/24
tags:
    - attack.t1059
    - attack.t1566
    - attack.t1027
    - attack.t1036
logsource:
    category: process_creation
    product: windows
detection:
    selection_script:
        CommandLine|contains:
            - 'cleaner.ps1'
            - 'Invoke-Expression'
            - 'ScriptBlock::Create'
    selection_python:
        CommandLine|contains:
            - '%AppData%\\Python'
            - 'ss.py'
            - 'flang'
    selection_amsi_bypass:
        CommandLine|contains:
            - 'AmsiUtils'
            - 'amsiInitFailed'
    condition: (selection_script and selection_python) or (selection_script and selection_amsi_bypass)
falsepositives:
    - Legitimate PowerShell scripts named cleaner.ps1 (low likelihood)
    - IT automation scripts deploying Python environments from AppData
level: high

References

• https://www.bleepingcomputer.com/news/security/new-synkloader-malware-uses-fake-windows-lock-screen-to-steal-passwords/