SynkLoader arrives as a fake IT help desk message on Microsoft Teams and ends with PhishLocker, a fake Windows lock screen designed to capture the password typed into it. Expel found the loader on 18 August 2026 and dated its first build to about 28 July.

Expel describes no exploit in the chain. It asks a person to run an installer, hosts that installer on a genuine Microsoft Azure storage address, and then asks for the password a second time through a screen that looks like Windows.

How does help desk impersonation lead to credential theft in Microsoft 365?

It starts with a request for help rather than a malicious file. Expel could not recover the full Teams conversation in the original incident, but it did recover metadata: an account on the <company>.onmicrosoft.com address pattern, Microsoft 365's default domain for a tenant, contacted the target under the name IT Service Desk followed by a fake personal name.

That contact convinced the user to download and install an MSI from a Microsoft Azure file storage endpoint. The installer presented itself as a "PowerShell Cleaner". Expel says the Azure address gave the file the appearance of coming from Microsoft.

One loader, several ways in

ReliaQuest, reported by The Hacker News on 24 August (updated 26 August), saw the SynkLoader PowerShell loader pushed through vishing and Microsoft Teams messages that impersonate IT support. It describes the same fraudulent "PowerShell Cleaner" MSI on Azure Blob Storage "despite variations in the initial contact method". Neither report counts how many organizations were targeted.

How does SynkLoader run once the installer is opened?

The MSI writes a PowerShell script, cleaner.ps1, and a ZIP archive, archive6.zip, to a PowershellCleaner folder under the user's local application data. The script runs automatically. It starts a hidden PowerShell window that rebuilds its command from hex values and executes it in memory, decrypts a second AES-CBC encrypted command, and unpacks the archive into a random 16-character folder under %AppData%. That folder name doubles as the victim ID for the rest of the infection.

A Python install that ships with the malware

Windows does not include Python, so the operators ship a minimal copy with a heavily obfuscated loader script, ss.py, precompiled libraries and two DLLs named like Microsoft runtime files. The first, msvcp150.dll, is a custom C# module that runs PowerShell in memory. The second, msvcp160.dll, is a native DLL that maps further DLLs into memory without writing them to disk. The loader and these two helpers are on disk; the later modules are not.

The check-in loop

The loader picks one of three hardcoded domains at random, builds a URL that includes the victim ID, and checks in every 90 to 120 seconds. Requests are encrypted with a ChaCha20 cipher whose constants the operators changed, and the loader runs whatever Python code the server sends back. Expel's summary of the design: send an encrypted ping, then decrypt and execute the reply.

What are the seven SynkLoader modules?

Expel reverse engineered the loader and built an emulator for its command channel. It fed the server a fake profile that claimed an Active Directory of several thousand systems, then recorded what came back. A scheduled-task alert had exposed the original infection, but the modules came from the decoy.

Timing suggests a human choice. After Expel's emulator reported a successful persistence install, nothing more arrived for over 12 hours. The next morning, around 8 a.m. Pacific, the operators sent a flurry of modules, which Expel says possibly means they picked the decoy by hand. When the reverse shell module failed against the emulator, the operators resent it 15 more times and then sent a status script.

How does the PhishLocker fake lock screen steal a password?

PhishLocker is a full-screen, borderless application of nearly 500 KB of code. It reads the current username and the lock screen background image from C:\Windows\Web\Screen, then draws a window built to resemble the Windows 11 lock screen with a password field. Expel had not seen malware use this technique locally; it compares it to full-screen fake login pages that browsers allowed years ago.

What gives it away

Expel's note on the design: it avoids heavily detected tools such as Mimikatz and gives the operator the raw password rather than a hash. Because many companies use single sign-on, a system password opens more doors than a hash that must be attacked through Kerberos or NTLM.

Why the proxy matters

TrafficRedirector connects out to the operator and then forwards traffic to any IP and port it is told to reach. Expel says that lets the operators use the victim's network position to reach internal services and to bypass IP allow-listing. Combined with the phished password, they can sign in to internal and external company systems without logins from unknown IP addresses or locations. This combination is Expel's reasoning about capability; the report does not document a completed intrusion.

Why standard controls miss it

Every step looks acceptable alone. A Microsoft 365 tenant domain is a real domain. A blob storage address is a real Microsoft address. PowerShell runs in memory, so the script never sits on disk as a file. Expel says that driving PowerShell and DLL loading from Python likely helps evade EDR, which is less likely to flag Python scripts, and that creating the scheduled task through a COM interface rather than schtasks.exe sidesteps detections that watch command lines.

Indicators age quickly. Expel did not publish hashes for the modules because several of them hardcode the victim-specific ID, so each infection produces different files. ReliaQuest makes the same point from the delivery side: trusted cloud hosting, IT-support impersonation, in-memory PowerShell and Python components fetched at runtime reduce visibility across email, network and sandbox-based controls.

The channel is the other gap. Expel's incident began in Teams, and ReliaQuest adds phone calls. A control that inspects only mail never sees the first contact.

How AegisAI protects against it

The reported first contact was a Teams message, and ReliaQuest adds phone calls, so no mail-borne lure has been published. The same pretext could arrive as an email carrying an installer link; that is AegisAI's inference, not a reported delivery route. For that email-borne case, the approach below applies.

AegisAI's agents evaluate the message and the destination it points to together, and pull a malicious message out of mailboxes before users see or click it.

More on how that works: inbound email security.

What the reporting does not tell us

Scale. Expel describes one client incident and one decoy system. Neither Expel nor The Hacker News gives a count of targeted or compromised organizations.

The lure itself. Expel did not recover the full Teams conversation, so the wording used by the fake help desk is unknown. No email version of the lure has been published.

Channel mix. Teams, email-domain naming and vishing are all reported, but no source says what share of attempts used each.

Intent. Expel could not establish the operator's end goal. The ransomware or access-broker assessment is low to medium confidence and rests on the way the profiler counts Active Directory computers and on the loader's resemblance to loaders used by such groups.

Indicators. The published indicators are from one infection. The Azure storage path and the command-and-control domains can change.

MITRE ATT&CK mapping

Recommendations for defenders

Indicators published by Expel

FAQ

References