# SynkLoader: Modular Multi-Language Loader Deployed via Microsoft Teams Phishing, Likely Ransomware Precursor

> Expel researcher Marcus Hutchins identified SynkLoader, a modular Python/PowerShell/C#/C++ malware toolkit delivered via Microsoft Teams messages impersonating an internal IT Service Desk. Victims are tricked into installing a fake 'PowerShell Cleaner' MSI from Azure Blob Storage that unpacks a fake Windows 11 lock screen credential-stealer, a PowerShell RAT, a VNC-style remote-control module (StreamMaster), and a reverse-proxy module (TrafficRedirector), then profiles the Active Directory environment in a way consistent with sizing a ransom demand.

- **Published:** 2026-08-24T00:00:00Z
- **Last reviewed:** 2026-08-24T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2131
- **ID:** TL-2026-2131
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Expel discovered SynkLoader on 2026-08-18 after EDR flagged an anomalous COM-created scheduled task in a customer environment; file metadata and compile timestamps place the toolkit's first build and distribution around 2026-07-28. The attack begins with an operator impersonating a company's IT Service Desk over Microsoft Teams from an external Microsoft 365 tenant, directing the target to download and run an MSI installer disguised as a 'PowerShell Cleaner' utility and hosted on Microsoft Azure Blob Storage (filereserve.blob.core.windows[.]net) to lend it legitimacy.

The MSI drops an obfuscated PowerShell script (cleaner.ps1) that decodes and decrypts (Base64 / AES-CBC) further instructions in memory via nested Invoke-Expression calls, then extracts an archive (archive6.zip) containing a self-contained Python runtime into a randomly named directory under %AppData%. The environment launches a Python loader (ss.py) via pythonw.exe rather than a visible console, and drops decoy files named to mimic legitimate Microsoft Visual C++ runtime DLLs (msvcp150.dll, msvcp160.dll). Persistence is established by creating a randomly named scheduled task through the Windows Task Scheduler COM interface — rather than schtasks.exe — configured to relaunch the loader at user logon and daily at 10:00 local time, reducing command-line telemetry that behavioral detections typically key on.

Once resident, SynkLoader operates as a modular capability set: a System Profiler component enumerates hostname, username, privilege level, running processes, services, domain membership, and the count of Active Directory-joined computers; PhishLocker renders a full-screen GUI that mimics the Windows 11 lock screen to harvest the victim's password; an Interactive Shell module provides a PowerShell-based remote command channel (RAT); StreamMaster provides VNC-style desktop streaming with remote mouse/keyboard input; and TrafficRedirector turns the host into a reverse proxy, giving the operator a path into the internal corporate network or onward internet access through the victim's IP. A module-status script reports which components and threads are currently active. The loader checks in with hardcoded command-and-control domains roughly every 90-120 seconds, encrypting JSON tasking with a ChaCha20 stream cipher that uses non-standard ('modified Sigma') constants, and derives the per-victim encryption key from the randomly generated installation directory name — which also serves as a victim identifier.

Expel published indicators of compromise but cautioned that SynkLoader's module-level file hashes are regenerated per infection, making hash-based detection largely ineffective; defenders are pointed instead at the campaign's Teams-impersonation pretext, the Azure-hosted MSI delivery URL, the named C2 domains, and the COM-based scheduled-task persistence pattern. Hutchins assessed with low-to-medium confidence that SynkLoader is operated by a ransomware group or an initial access broker, based specifically on the toolkit's emphasis on counting AD-joined systems — a metric commonly used by ransomware operators to size a ransom demand — though no specific actor, ransomware family, or IAB brand has been attributed as of this writing.

## MITRE ATT&CK

- T1684.001 Impersonation
- T1566.003 Spearphishing via Service
- T1204.002 Malicious File
- T1218.007 Msiexec
- T1059.001 PowerShell
- T1059.006 Python
- T1053.005 Scheduled Task
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036.005 Match Legitimate Resource Name or Location
- T1056.002 GUI Input Capture
- T1082 System Information Discovery
- T1033 System Owner/User Discovery
- T1018 Remote System Discovery
- T1057 Process Discovery
- T1021.005 VNC
- T1071 Application Layer Protocol
- T1573.001 Symmetric Cryptography
- T1090.001 Internal Proxy

## Sources

- [New SynkLoader malware pushed in Microsoft Teams phishing campaign](https://www.bleepingcomputer.com/news/security/new-synkloader-malware-pushed-in-microsoft-teams-phishing-campaign/)
- [Tricky 'SynkLoader' Multitool May Herald Ransomware](https://www.darkreading.com/threat-intelligence/tricky-synkloader-multitool-ransomware)
- [SynkLoader: when you throw in everything but the kitchen sink](https://expel.com/blog/synkloader-when-you-throw-in-everything-but-the-kitchen-sink/)
- [WordlistLoader Delivers Amatera via ClickFix, SynkLoader Phishes Windows Passwords](https://thehackernews.com/2026/08/wordlistloader-delivers-amatera-via.html)
- [Microsoft Teams Phishing Deploys New SynkLoader Malware to Steal Windows Passwords](https://cybersecuritynews.com/microsoft-teams-phishing/)
- [New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks](https://gbhackers.com/new-synkloader-malware/)
- [SynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows Passwords](https://cyberpress.org/synkloader-malware-spreads-through-microsoft-teams/)
- [SynkLoader Deploying Multi-Stage Modules via Teams Phishing](https://dev.to/anoymask/synkloader-deploying-multi-stage-modules-via-teams-phishing-1cal)
- [SynkLoader Malware Targets Corporate Networks with Password Theft and Remote Access](https://www.news4hackers.com/synkloader-malware-targets-corporate-networks-with-password-theft-and-remote-access)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2131