SynkLoader malware distribution via Microsoft Teams phishing
Malware Activity
Summary
Hide ▲
Show ▼
The SynkLoader malware family is being pushed through Microsoft Teams phishing to steal credentials with a fake Windows lock screen, giving attackers remote access and internal-network reach on infected devices.
Related Happenings
SynkLoader Microsoft Teams help-desk phishing campaign
Campaign
H score35
First: 21.08.2026 21:01
Last: 21.08.2026 21:01
Sources 1
How related:
The attacker impersonates the target company's IT help desk, a tactic Microsoft highlighted earlier this year as increasingly common in multi-stage attacks.
About this happening:
The SynkLoader campaign is using Microsoft Teams help-desk impersonation and a fake PowerShell Cleaner MSI to push victims into a credential-theft chain that can open...
SynkLoader Microsoft Teams help-desk phishing campaign
CampaignHow related: The attacker impersonates the target company's IT help desk, a tactic Microsoft highlighted earlier this year as increasingly common in multi-stage attacks.
About this happening: The SynkLoader campaign is using Microsoft Teams help-desk impersonation and a fake PowerShell Cleaner MSI to push victims into a credential-theft chain that can open...
TWINLOOT Microsoft services C2 implant activity
Malware Activity
H score29
First: 18.08.2026 15:38
Last: 18.08.2026 15:38
Sources 1
About this happening:
TWINLOOT is a newly disclosed Python implant that hides command-and-control inside Microsoft services, increasing the odds that malicious traffic blends into normal en...
TWINLOOT Microsoft services C2 implant activity
Malware ActivityAbout this happening: TWINLOOT is a newly disclosed Python implant that hides command-and-control inside Microsoft services, increasing the odds that malicious traffic blends into normal en...
Midnight Blizzard CaptiveCrunch hospitality Wi-Fi phishing campaign
Campaign
H score37
First: 04.08.2026 03:17
Last: 04.08.2026 03:17
Sources 1
About this happening:
Microsoft linked CaptiveCrunch to Midnight Blizzard / APT29, a global operation that abuses hospitality Wi‑Fi to steal Microsoft 365 accounts and deliver malware....
Midnight Blizzard CaptiveCrunch hospitality Wi-Fi phishing campaign
CampaignAbout this happening: Microsoft linked CaptiveCrunch to Midnight Blizzard / APT29, a global operation that abuses hospitality Wi‑Fi to steal Microsoft 365 accounts and deliver malware....
Operation BlueDash Microsoft Teams phishing campaign delivering Level RMM and ScreenConnect
Campaign
H score45
First: 27.07.2026 15:37
Last: 27.07.2026 15:37
Sources 1
About this happening:
The Operation BlueDash phishing campaign is using a fake Microsoft Teams update flow to install Level RMM and ConnectWise ScreenConnect, creating persistent remote...
Operation BlueDash Microsoft Teams phishing campaign delivering Level RMM and ScreenConnect
CampaignAbout this happening: The Operation BlueDash phishing campaign is using a fake Microsoft Teams update flow to install Level RMM and ConnectWise ScreenConnect, creating persistent remote...
Kratos ecosystem shift changes threat-actor operations
Threat Actor Meta
H score39
First: 22.07.2026 02:07
Last: 22.07.2026 02:07
Sources 1
About this happening:
The Kratos phishing-as-a-service ecosystem was dismantled after it scaled to more than 1,800 criminal customers, exposing a subscription model that drove roughly 15,000...
Kratos ecosystem shift changes threat-actor operations
Threat Actor MetaAbout this happening: The Kratos phishing-as-a-service ecosystem was dismantled after it scaled to more than 1,800 criminal customers, exposing a subscription model that drove roughly 15,000...
Timeline
-
21.08.2026 21:01 1 articles · 1h ago
SynkLoader first compiled and distributed around July 28, 2026
Technical Analysis UpdateAnalysis of compile dates and file timestamps places SynkLoader's first compilation and distribution around July 28, 2026. The malware is delivered through Microsoft Teams phishing that impersonates the target company's IT help desk and steers victims toward a fake PowerShell Cleaner (.MSI) hosted in Microsoft Azure to steal credentials with a fake Windows lock screen.
Show sources
- New SynkLoader malware pushed in Microsoft Teams phishing campaign — www.bleepingcomputer.com — 21.08.2026 21:01
-
21.08.2026 21:01 2 articles · 1h ago
SynkLoader phishing campaign uses a fake PowerShell Cleaner MSI
Initial DisclosureExpel's public analysis describes SynkLoader modules extracted from a honeypot-pinged attacker C2, including System Profiler, Persistence Module, PhishLocker, TrafficRedirector, Interactive Shell (RAT), StreamMaster (VNC), and Module Status Script. The disclosure also provides indicators of compromise and notes that module hashes are unique per infection, limiting hash-based defense.
Show sources
- New SynkLoader malware pushed in Microsoft Teams phishing campaign — www.bleepingcomputer.com — 21.08.2026 21:01
- New SynkLoader malware pushed in Microsoft Teams phishing campaign — www.bleepingcomputer.com — 21.08.2026 21:01