cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

SynkLoader Malware Uses Teams Phishing and Fake Lock Screen to Steal Credentials

· Original article ↗

Summary

Expel says SynkLoader is delivered through Microsoft Teams phishing and a fake PowerShell Cleaner MSI. Its modules can capture credentials and enable remote access; Active Directory profiling suggests possible ransomware use.

Key points

  • Attackers impersonate a target company’s IT help desk and direct victims to a fake “PowerShell Cleaner” MSI hosted on Microsoft Azure.
  • The installer extracts a PowerShell script and a ZIP archive containing Python components and fake Microsoft runtime DLLs.
  • Expel identified modules for system profiling, scheduled-task persistence, traffic redirection, remote PowerShell commands, and VNC desktop control.
  • PhishLocker displays a fake Windows lock screen to capture passwords; Alt+Tab can reveal that it is a full-screen application.
  • Expel observed the actor run profiling commands in a honeypot before disconnecting, and used an emulator to confirm hands-on-keyboard activity.
  • The focus on measuring Active Directory environments suggests possible ransomware use, but the article does not confirm ransomware activity.
  • The article recommends independently verifying IT requests and avoiding unsolicited MSI files.

Article Details

Attack Vectors
  • Attackers impersonate a target company's IT help desk in Microsoft Teams phishing campaigns and direct victims to install a fake “PowerShell Cleaner” MSI hosted in Azure.
  • SynkLoader's PhishLocker module displays a fake Windows lock screen to capture the victim's account password.
  • SynkLoader's TrafficRedirector module creates a reverse proxy that can provide access to internal network services or route internet traffic through the infected computer.
  • SynkLoader's Interactive Shell module enables remote execution of PowerShell commands.
Defensive Notes
  • Verify unexpected IT requests independently.
  • Avoid installing unsolicited MSI files.
  • If an unexpected lock screen appears, use Ctrl+Alt+Delete or Alt+Tab to help determine whether it is authentic.

MITRE ATT&CK

T1007 · System Service DiscoveryThe System Profiler collects information about services on the infected computer.T1033 · System Owner/User DiscoveryThe System Profiler collects the infected computer's username and privilege level.T1053.005 · Scheduled TaskSynkLoader's Persistence Module creates a scheduled task to launch the malware at logon and daily at 10 a.m.T1056.002 · GUI Input CapturePhishLocker presents a fake Windows lock screen to capture the victim's password.T1057 · Process DiscoveryThe System Profiler collects information about running processes.T1059.001 · PowerShellSynkLoader's Interactive Shell module lets attackers remotely execute PowerShell commands.T1082 · System Information DiscoveryThe System Profiler collects the infected computer's hostname and other environment details.T1090.001 · Internal ProxyTrafficRedirector creates a reverse proxy that lets attackers reach internal network services through the infected computer.T1204.002 · Malicious FileVictims are tricked into installing a fake PowerShell Cleaner MSI that delivers SynkLoader.T1566.003 · Spearphishing via ServiceThe campaign uses Microsoft Teams phishing messages impersonating the target company's IT help desk.

People

Marcus HutchinsExpel security researcher who discussed SynkLoader's capabilities and the evidence suggesting it may be used in ransomware operations.

Malware

SynkLoaderSynkLoader is a newly identified malware family spread through Microsoft Teams phishing campaigns that impersonate a company’s IT help desk and trick victims into installing a fake “PowerShell Cleaner” MSI from

Vendors

MicrosoftSynkLoader is a newly identified malware family spread through Microsoft Teams phishing campaigns that impersonate a company’s IT help desk and trick victims into installing a fake “PowerShell Cleaner” MSI from

Products

Azurea company’s IT help desk and trick victims into installing a fake “PowerShell Cleaner” MSI from Microsoft Azure.Microsoft TeamsSynkLoader is a newly identified malware family spread through Microsoft Teams phishing campaigns that impersonate a company’s IT help desk and trick victims into installing a fake “PowerShell Cleaner” MSI fromMicrosoft WindowsIt uses a fake Windows lock screen to steal credentials and can deploy modules for persistence, traffic redirection, remote shell access, and desktop control, with activity suggesting possible ransomware preparation.PowerShellphishing campaigns that impersonate a company’s IT help desk and trick victims into installing a fake “PowerShell Cleaner” MSI from Microsoft Azure.

Related Articles