SynkLoader malware steals Windows passwords via fake lock screen
SynkLoader is a new malware toolkit that attackers deliver by posing as internal IT support on Microsoft Teams. Once a victim installs it, the malware pops up a fake Windows lock screen to steal their password, then gives the attacker remote access to move around the company's network.
- Report priority
- Medium
- Targets
- Azure Blob Storage+1 more
How it works
An attacker messages an employee on Microsoft Teams from a look-alike internal address, poses as IT support, and talks them into downloading and running an MSI file disguised as a cleanup tool, which then quietly unpacks and runs hidden PowerShell and Python code entirely in the computer's memory.
What to do
Instead, check whether anyone in your organization downloaded and ran an MSI file called PowershellCleaner from a Teams message, especially any activity since around July 28, 2026, or unexplained scheduled tasks with random names created outside schtasks.exe.
There is no software patch since this is a phishing and malware campaign rather than a product flaw, so report look-alike IT Service Desk messages on Teams, verify unexpected onmicrosoft.com senders before opening attachments, and have your security team check logs for the domains, and for files named msvcp150.dll or msvcp160.dll that do not match genuine Microsoft Visual C++ files.
Technical details
Affected software: Azure Blob Storage, Active Directory
Someone posing as the company's IT Service Desk messages an employee on Microsoft Teams from an @company.onmicrosoft.com address. The employee downloads and runs an MSI file called PowershellCleaner that the attacker hosts on Azure cloud storage. The installer secretly unpacks a hidden PowerShell script and a bundled Python program, which then contacts the attacker's servers every 90 to 120 seconds. It shows a screen made to look exactly like the Windows lock screen and captures the password the employee types to unlock it, then lets the attacker explore the company's network.
SynkLoader's MSI installer drops a PowerShell script that decrypts and runs a bundled Python interpreter (pythonw.exe) entirely in memory, avoiding files that antivirus tools would normally scan. Its main module, ss.py, beacons to rotating C2 domains using a modified ChaCha20 cipher and passes decrypted server responses straight into Python's exec function, giving operators live remote code execution without dropping new files. A disguised DLL, msvcp150.dll, exposes PowerShell functions to the Python loader, while a second disguised DLL, msvcp160.dll, creates a hidden scheduled task via the Task Scheduler COM interface for persistence. The credential-theft module renders a screen mimicking the Windows 11 lock screen to capture passwords.