A new phishing campaign has emerged that uses Microsoft Teams messages impersonating IT support to install SynkLoader malware capable of stealing Windows user credentials, researchers warn. The scheme deploys multiple stages—many of them operating in memory—and even includes a fake Windows lock screen designed to capture live passwords, not just password hashes. The threat recently surfaced through investigations by the security firm Expel, which traced its origins back to late July 2026. ([cybersecuritynews.com](https://cybersecuritynews.com/microsoft-teams-phishing/))
How the Attack Works
Attackers begin by sending Teams messages that appear to come from internal IT, often from addresses ending in “company.onmicrosoft.com.” The recipient is told to install a so-called “fix” or “update,” usually delivered via an MSI installer hosted on Azure Blob Storage. That file presents itself as “PowerShell Cleaner” and unpacks a ZIP archive plus PowerShell scripts into the user’s AppData folder. From there, a Python-based loader is launched and later activity is largely kept in memory. ([cybersecuritynews.com](https://cybersecuritynews.com/microsoft-teams-phishing/))
Once installed, SynkLoader gathers an extensive fingerprint of the infected machine, including the computer’s name, active username, running processes, privilege levels, services, and details from Active Directory. A core loader checks in with command-and-control servers every 90 to 120 seconds and can download and execute additional Python-based commands. ([cybersecuritynews.com](https://cybersecuritynews.com/microsoft-teams-phishing/))
Credential Theft & Persistence Features
A key concern is “PhishLocker,” a module that mimics the Windows 11 lock screen. It grabs the current user’s name and wallpaper, then displays what looks like the real login screen. Even when users enter the correct password, this fake prompt captures whatever is entered. In settings where single sign-on is used, even one legitimate credential can grant broader access. ([cybersecuritynews.com](https://cybersecuritynews.com/microsoft-teams-phishing/))
To maintain long-term access, the malware creates a scheduled task under a randomized name. This task is triggered both at logon and at about 10 a.m. local time, allowing SynkLoader to survive restarts and resume operations. Other modules include a reverse proxy-like traffic redirector to funnel internal network resources through the compromised machine, plus remote-control tools via VNC and PowerShell. ([cybersecuritynews.com](https://cybersecuritynews.com/microsoft-teams-phishing/))
Indicators and Mitigations
Expel’s report provides several Indicators of Compromise (IoCs) including the MSI download URL (Azure Blob link), multiple SHA-256 hashes for the installer, payloads, and individual modules, and command-and-control domains like neversoftmain.net and rootfarmapp.net. ([cybersecuritynews.com](https://cybersecuritynews.com/microsoft-teams-phishing/))
Defensive actions recommended include verifying any Teams message by contacting IT via an independently known channel; scrutinizing unexpected MSI downloads and newly created scheduled tasks; and keeping an eye on unusual in-memory PowerShell activity. Monitoring Teams audit logs and blocking or observing traffic to the listed C2 domains can help detect breaches early. ([cybersecuritynews.com](https://cybersecuritynews.com/microsoft-teams-phishing/))
The toolkit has been flagged with low to medium confidence as possibly linked to a ransomware group or a broker selling network access. ([cybersecuritynews.com](https://cybersecuritynews.com/microsoft-teams-phishing/))
As remote collaboration tools remain central to business operations, this attack underscores how phishing can evolve beyond stolen login pages. SynkLoader doesn’t just mimic IT support—it delivers tools that embed deeply inside systems, steal live credentials, and enable lateral movement. The risk is especially acute for organizations relying heavily on internal portals or single sign-on. What to watch: how quickly security vendors adapt detection for in-memory stages, phishing variants inside collaboration platforms, and whether legal or regulatory response increases around credential-theft malware campaigns.
