Security researchers have uncovered a phishing campaign that impersonates internal IT helpdesks over Microsoft Teams to trick employees into installing a new malware family called SynkLoader. The attacker sends a direct message posing as IT support, then talks the target into running a file named something like "PowerShell Cleaner" — an MSI installer hosted on Microsoft Azure, which makes the download look legitimate because it comes from a trusted domain rather than an obviously suspicious link.
Once installed, SynkLoader doesn't just steal a password and move on. Researchers at incident-response firm Expel, who found the malware after it triggered one of their honeypots, describe it as a multi-stage loader that drops several modules: one profiles the infected machine, one sets up persistence so it survives a reboot, and one — nicknamed PhishLocker — throws up a convincing fake Windows lock screen to capture the victim's real login credentials as they type them in. Other modules give the attacker a remote-access channel, a network tunnel, and an interactive PowerShell shell into the compromised system. File timestamps show it was first compiled and put into use around 28 July 2026; the campaign itself was only publicly documented this week.
What this means for your business
- Treat any unsolicited "IT support" message on Teams — especially one asking you to install or run something — the same way you'd treat a suspicious email: verify it through a second channel, such as calling a known internal extension, before acting on it. Genuine IT teams rarely open with a cold DM asking you to install a "cleaner" tool.
- Never install an MSI or EXE because a chat message told you to, even if the download link points to a recognisable domain like Azure or SharePoint. A trustworthy-looking host doesn't mean a trustworthy file.
- If your screen suddenly locks in a way that feels out of place, try Ctrl+Alt+Delete or Alt+Tab before typing your password. A genuine Windows lock screen survives that; a fake overlay usually doesn't.
- If Teams in your organisation allows messages from external or unmanaged accounts, review that setting — restricting who can DM your staff removes the entry point this campaign relies on.
- If anyone did run the installer, treat it as an active incident rather than a one-off mistake: isolate the device from the network, rotate that user's credentials and any accounts the machine could reach, and check for unusual internal network scanning, which researchers say often follows this kind of infection.
Microsoft Teams is now the default chat tool for a lot of small and mid-size businesses, and most employees are trained to be wary of email attachments but not of a colleague-looking DM inside a tool they trust every day — which is exactly the gap this campaign is built to exploit.