SynkLoader: a Teams message from a lookalike tenant, an MSI called 'PowerShell Cleaner', and a six-module toolkit whose fake lock screen harvests the domain password its own tunnel then uses from the victim's IP
Expel published an analysis on 2026-08-20 of SynkLoader, a loader it found on 2026-08-18 while investigating an endpoint-detection alert on a scheduled task in a client network, and for which it could find no prior public reference (Expel, 2026-08-20). The name is a play on its breadth — Expel describes it as an "everything but the kitchen sink" approach — and the reason it belongs in front of a public-sector defender is the delivery, not the tooling: the operator arrives over Microsoft Teams, from a <username>@<company>.onmicrosoft.com address (the default mail domain Microsoft 365 assigns a tenant), posing as the target's own IT service desk under a fabricated staff name, and persuades the user to download and install an MSI presented as a "PowerShell Cleaner" and hosted on Azure blob storage — giving the download the appearance of coming from Microsoft. That inverts the direction staff are trained to be suspicious in: the lure is not an external email but an internal-looking chat from support.
Six modules follow, and Expel notes the chain "ships a long chain of attack tools, which bridge multiple separate programming languages, with some modules using as many as three programming languages at once." A system profiler loads a C# module carrying the name of a Microsoft Visual C++ runtime library, which exports functions to run PowerShell in memory through an embedded Python interpreter, and collects hostname, current user, privilege level, running processes, installed services, the Active Directory domain name and — the detail Expel leans on — a count of AD-joined computers. A persistence module is reached through a second fake-runtime-named DLL that maps libraries into memory without writing them to disk, and the way it installs its scheduled task is a deliberate evasion rather than an implementation detail: Expel documents it registering the task through the Task Scheduler COM interface rather than the command-line utility, specifically to sidestep behavioural detections that inspect command-line arguments or watch for the scheduled-task binary being invoked. That matters for hunting, because the usual high-value signal — a suspicious schtasks command line — is exactly what this build avoids producing. PhishLocker renders a counterfeit full-screen Windows lock screen to steal the user's system login credentials, going as far as retrieving the machine's real lock-screen background image from its own on-disk location and re-focusing itself to defeat Alt+Tab; Expel's analysis host gave it away because the fake mimicked Windows 11 while the machine ran Windows 10, producing visible mismatches in clock and icon placement, password-box theming and the absence of the background blur Windows applies when the password prompt has focus. TrafficRedirector is a backconnect proxy using a protocol resembling HTTP CONNECT: it dials out to the operator, waits for an address and port, and then forwards traffic — which Expel states "can enable the threat actors to connect to internet services using the infected machine IP address, bypassing corporate IP allow-listing," and equally lets the operator reach internal services that only listen on the LAN. An interactive shell polls one endpoint for commands and posts results to another. A screen-streaming module written in Python connects outward rather than listening, compresses screenshots and forwards mouse and keyboard input into the live session — notably not a hidden-desktop implementation, so the activity would be visible to a logged-on user; Expel assesses from its unusually formal comments and the absence of any matching open-source project that it was likely AI-assisted.
The two halves that matter together are PhishLocker and TrafficRedirector. Expel's own framing: "When combined with the system password phishing model, threat actors can use the infected user's username and password to log into both internal and external company systems, all without triggering alerts based on logins from unknown IPs or geolocations." A cleartext domain password is also worth more than a hash here because single sign-on turns it into access across every federated application, without the constraints of pass-the-hash or Kerberos relay. Expel assesses at low-to-medium confidence that the toolkit belongs to a ransomware group or an initial-access broker selling to one, resting that on the AD-computer count — which matters most to an actor whose profit scales with the size of the network it disrupts — and on the loader's resemblance to others previously used by such groups. Build timestamps place the components around late July 2026, and one module's debug path leaked the developer's local account name.
Triage: a real IT service desk contacting a user over Teams and asking them to install something is not unusual, which is what makes this work — the discriminators are tenant and provenance, not behaviour. Genuine internal support messages come from a sender inside the organisation's own verified domain, not from an onmicrosoft.com default-domain address belonging to a different tenant, and genuine software arrives through the organisation's own management or software-distribution channel rather than as an operator-supplied link to consumer-facing cloud storage. On the endpoint, an MSI that installs an embedded Python interpreter and DLLs bearing Visual C++ runtime names outside a legitimate application directory is the anomaly; the runtime names are the masquerade, so the signal is the location and the installing parent, not the filename. For the lock-screen module, the honest discriminator is that Windows never asks a user to re-authenticate through a newly launched application: a full-screen credential prompt whose owning process is not the operating system's own logon UI is a fake, and a mismatch between the rendered lock-screen style and the host's actual Windows version is what exposed this one.
The loader ships a long chain of attack tools, which bridge multiple separate programming languages, with some modules using as many as three programming languages at once.
It can enable the threat actors to connect to internet services using the infected machine IP address, bypassing corporate IP allow-listing.
When combined with the system password phishing model, threat actors can use the infected user’s username and password to log into both internal and external company systems, all without triggering alerts based on logins from unknown IPs or geolocations.
Defender actions
- Restrict external and cross-tenant Microsoft Teams chat to an allow-list of federated domains, or disable it — the delivery depends on an unsolicited message from an outside tenant reaching an end user, and this is a tenant setting rather than a detection.
ATT&CK mapping
16 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Resource Development TA0042
T1584.006Compromise Infrastructure: Web Services
Adversaries may compromise access to third-party web services that can be used during targeting. A variety of popular websites exist for legitimate users to register for web-based services, such as GitHub, Twitter, Dropbox, Google, SendGrid, etc. Adversaries may try to take ownership of a legitimate user's access to a web service and use that web service as infrastructure in support of cyber operations. Such web services can be abused during later stages of the adversary lifecycle, such as during Command and Control (Web Service), Exfiltration Over Web Service, or Phishing. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. By utilizing a web service, particularly when access is stolen from legitimate users, adversaries can make it difficult to physically tie back operations to them. Additionally, leveraging compromised web-based email services may allow adversaries to leverage the trust associated with legitimate domains.
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1566.003Phishing: Spearphishing via Service
Adversaries may send spearphishing messages via third-party services in an attempt to gain access to victim systems. Spearphishing via service is a specific variant of spearphishing. It is different from other forms of spearphishing in that it employs the use of third party services rather than directly via enterprise email channels.
Execution TA0002
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1059.001Command and Scripting Interpreter: PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
T1204.002User Execution: Malicious File
An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment. Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, .cpl, .reg, and .iso.
Persistence TA0003
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Privilege Escalation TA0004
T1053.005Scheduled Task/Job: Scheduled Task
Adversaries may abuse the Windows Task Scheduler to perform task scheduling for initial or recurring execution of malicious code. There are multiple ways to access the Task Scheduler in Windows. The schtasks utility can be run directly on the command line, or the Task Scheduler can be opened through the GUI within the Administrator Tools section of the Control Panel. In some cases, adversaries have used a .NET wrapper for the Windows Task Scheduler, and alternatively, adversaries have used the Windows netapi32 library and Windows Management Instrumentation (WMI) to create a scheduled task. Adversaries may also utilize the Powershell Cmdlet `Invoke-CimMethod`, which leverages WMI class `PS_ScheduledTask` to create a scheduled task via an XML path.
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1036.005Masquerading: Match Legitimate Resource Name or Location
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them. This is done for the sake of evading defenses and observation.
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1620Reflective Code Loading
Adversaries may reflectively load code into a process in order to conceal the execution of malicious payloads. Reflective loading involves allocating then executing payloads directly within the memory of the process, vice creating a thread or process backed by a file path on disk (e.g., Shared Modules).
T1684.001Social Engineering: Impersonation
Adversaries may impersonate a trusted person or organization in order to persuade and trick a target into performing some action on their behalf. For example, adversaries may communicate with victims (via Phishing for Information, Phishing, or Internal Spearphishing) while impersonating a known sender such as an executive, colleague, or third-party vendor. Established trust can then be leveraged to accomplish an adversary’s ultimate goals, possibly against multiple victims.
Credential Access TA0006
T1056.002Input Capture: GUI Input Capture
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).
Discovery TA0007
T1007System Service Discovery
Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as <code>sc query</code>, <code>tasklist /svc</code>, <code>systemctl --type=service</code>, and <code>net start</code>. Adversaries may also gather information about schedule tasks via commands such as `schtasks` on Windows or `crontab -l` on Linux and macOS.
T1018Remote System Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.
T1057Process Discovery
Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Administrator or otherwise elevated access may provide better process details. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
T1082System Information Discovery
An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use this information to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. This behavior is distinct from Local Storage Discovery which is an adversary's discovery of local drive, disks and/or volumes.
Collection TA0009
T1056.002Input Capture: GUI Input Capture
Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control).
T1113Screen Capture
Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as <code>CopyFromScreen</code>, <code>xwd</code>, or <code>screencapture</code>.
Command and Control TA0011
T1090Proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications to a command and control server to avoid direct connections to their infrastructure. Many tools exist that enable traffic redirection through proxies or port redirection, including HTRAN, ZXProxy, and ZXPortMap. Adversaries use these types of proxies to manage command and control communications, reduce the number of simultaneous outbound network connections, provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion. Adversaries may chain together multiple proxies to further disguise the source of malicious traffic.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.