New SynkLoader Malware Uses Microsoft Teams and Fake Windows Lock Screens to Steal Enterprise Credentials
Expel discovered a new malware family delivered through Microsoft Teams help-desk phishing that uses Azure-hosted payloads and a fake Windows lock screen to steal credentials.
Why it matters: SynkLoader shows attackers exploiting trusted collaboration platforms and Microsoft-hosted infrastructure to bypass email-centric defenses and steal enterprise credentials.
Security researchers have identified a new malware framework distributed through Microsoft Teams phishing campaigns in which attackers impersonate corporate IT support personnel.
Expel named the malware SynkLoader after investigating attacks that directed employees to install a fake system-cleanup application hosted on Microsoft Azure.
Once executed, the malware can display a convincing fake Windows lock screen designed to capture a user’s system credentials.
SynkLoader also contains networking capabilities that can allow attackers to route traffic through the compromised employee’s machine and access other corporate systems.
The campaign is significant because it exploits trust in enterprise collaboration software rather than relying exclusively on conventional phishing email.
Attackers increasingly impersonate IT help desks through Teams and other collaboration platforms, where employees may be less suspicious of unsolicited support messages.
For security teams, the campaign reinforces an emerging identity-security principle: collaboration messages requesting software installation, remote support or credential entry should be treated with the same scrutiny organizations already apply to suspicious email.