A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen.

Threat actors are leveraging Microsoft Teams to distribute SynkLoader malware, highlighting the growing abuse of trusted collaboration platforms for phishing attacks.

Cybersecurity researchers have flagged two new malware families called WordlistLoader and SynkLoader that's used to deliver next-stage payloads and likely sell access to ransomware groups. According to findings from Gen Digital, WordlistLoader is being used to deliver Amatera Stealer (aka ACR Stealer or AcridRain Stealer) via ClearFake campaigns, which employ the ClickFix (aka FakeCaptcha)

Attackers have used Microsoft Teams help-desk impersonation to persuade a Windows user to install SynkLoader, a modular malware family that can display a counterfeit Windows lock screen to collect…

SynkLoader: New Malware Uses Microsoft Teams Phishing to Target Windows Networks

A newly documented malware family called SynkLoader is using Microsoft Teams phishing, a fake IT support tool and a convincing imitation of...

Last Updated: 2026-08-24T14:49:19Z (UTC) What’s Happening The latest research from Marcus Hutchins (malwaretech) at Expel is a humdinger of a read, with some really creative behaviors. First, we have Teams phishing as a delivery mechanism. I don’t know how many folks have reviewed their external access Teams policies, but the more you can lock them down, the better. Then you have obfuscated PowerShell (a classic), that creates Script Blocks via [System.Management.Automation.ScriptBlock]:...

Fake IT help desk on Teams, fake "PowerShell Cleaner" MSI hosted on a real Azure URL. That's how SynkLoader gets in, then hands operators a password-stealing lock screen and live desktop control. #infosec #cybersecurity

A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen. [...]

SynkLoaderは、Python、C#、C++、PowerShell、そしてメモリ常駐型ペイロードを組み合わせてエンドポイント検知を回避する、新たに確認されたモジュール型マルウェアフレームワークです。Anti-malwaresoftware Microsoft Teamsを悪用したフィッシングを通じて配布されるこ

This one caught my attention because it’s a newer development of a technique we’ve already seen becoming increasingly popular. The attacker doesn’t need a vulnerability....

Expelの研究者が、偽のIT部門からのTeamsメッセージ経由で拡散するバックドア「SynkLoader」について警告マルウェアのモジュールには、OSパスワードを窃取する偽のログイン画面「PhishLocker」や、遠隔操作用の「Interactive Shell」が含まれる対策: 見覚えのないTeamsのダイ

A new phishing campaign is actively distributing SynkLoader, a newly discovered multi-stage malware, by impersonating IT support staff through Microsoft Teams messages. Threat actors are leveraging th...

Cybersecurity researchers at Gen Digital identified two new malware families, WordlistLoader and SynkLoader, used to deploy next-stage payloads and potentially sell access to ransomware groups. WordlistLoader is actively delivering Amatera Stealer (also known as ACR Stealer or AcridRain Stealer) through ClearFake campaigns, which leverage the ClickFix (or FakeCaptcha) technique. No specific dates, victim counts, or technical indicators such as CVE IDs were disclosed in the findings. The malware families appear designed for credential theft and follow-on exploitation, though exact impacts beyond payload delivery remain unspecified. The report did not detail geographic targeting or affected sectors.

The malware family SynkLoader has been identified as an advanced multitool with multilingual capabilities, incorporating a screen-hijacking technique previously used in older threats to facilitate password theft. It includes novel features beyond traditional credential harvesting, though specific technical details or CVE IDs were not disclosed. The malware's functionality suggests potential use as a precursor to ransomware attacks, though no confirmed incidents were reported. No exact timeline, affected organizations, or geographic targeting was specified in the available information. The threat was documented by researchers but lacks explicit attribution to a known threat actor or group.

At a glance Factor Details Malware Family SynkLoader Threat Actor Suspected initial access broker or ransomware affiliate (Low-to-medium confidence) Target or Victims Corporate networks and enterprise employees Delivery Vector Microsoft Teams spear-phishing messages posing as IT helpdesk staff Key Capabilities Multi-language execution, fake lock-screen phishing, and backconnect proxy tunneling Source Expel Incident Response TL;DR Security researchers at Expel recently identified a novel threat called SynkLoader…

WordlistLoader delivers Amatera via ClearFake ClickFix attacks, while SynkLoader uses Teams phishing to steal Windows login credentials.

A previously unknown malware family dubbed SynkLoader is being distributed in Microsoft Teams phishing campaigns to steal credentials via a fake lock screen.