Reported by 3 outlets

Timeline

1. original reporting

   SynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows Passwords

   cyberpress.org · 50d ago · August 24th, 2026

   A previously undocumented malware loader, dubbed SynkLoader, that combines Python, C#, and native C++ components to evade detection, steal Windows credentials, and enable deep network access. First spotted on August 18, 2026, during an EDR alert triggered by a suspicious scheduled task, the malware appears to have been compiled around July 28, 2026, and shows hallmarks of ransomware or initial-access-broker tooling. The infection began with a Microsoft Teams message from an attacker posing as “IT Service Desk ,” using a spoofed @company.onmicrosoft.com address to appear legitimate. SynkLoader Malware Spreads Through Microsoft Teams The impersonator convinced the target to download an MSI installer, disguised as a “PowerShell Cleaner,” from an Azure Blob Storage URL, lending the payload false credibility by leveraging Microsoft’s own infrastructure. Once executed, the MSI drops a PowerShell script that runs entirely in memory using nested Invoke-Expression and ScriptBlock::Create calls, decrypting an AES-CBC payload before deploying a full embedded Python environment to %AppData% . The content of the fl\ang subdirectory (Source: expel) The core loader script, ss.py , beacons to one of several C2 domains including neversoftmain[.]net and rootfarmapp[.]net using a modified ChaCha20 cipher with altered “Sigma” constants, encrypting traffic with a randomly generated victim ID as the key. The loader’s real trick is layering languages to dodge behavioral detection: Python calls fake

2. update from bleepingcomputer.com

   SynkLoader malware pushed in Microsoft Teams phishing campaign

   bleepingcomputer.com · 53d ago · August 21st, 2026

   A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. The attacker impersonates the target company's IT help desk, a tactic Microsoft highlighted earlier this year as increasingly common in multi-stage attacks. Expel’s security researcher Marcus Hutchins explains that the attacks direct the victim to install a fake “PowerShell Cleaner” executable (.MSI) hosted in Microsoft Azure, making the download appear trustworthy. Analysis of the malware showed "compile dates and file timestamps indicating it was first compiled and distributed around July 28, 2026." The installer extracts a PowerShell script named cleaner.ps1 and a ZIP archive containing the Python framework, a malicious Python script, precompiled Python libraries, and several fake Microsoft runtime DLLs. SynkLoader ZIP archive content source: Expel Based on the breached environment profile and operational targets, the attackers select which modules to deploy. SynkLoader was named as such because of its unusual combination of Python, PowerShell, C#, and C++, sometimes blending up to three programming languages in a single module. Expel identified the following SynkLoader modules after setting up a honeypot pinging the attacker’s C2, posing as a legitimate victim: System Profiler — Collects the hostname, username, privilege level, running processes, services, domain details, and number of computers in Active Directory.

3. update from gbhackers.com

   SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks

   gbhackers.com · 50d ago · August 24th, 2026

   Delivered through Microsoft Teams phishing, the operation uses a convincing fake Windows lock screen to capture credentials before enabling network tunneling and interactive access to compromised enterprise environments. Compile timestamps and file metadata indicate the […] The post New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .