New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks

SynkLoader, a newly identified modular malware framework that combines Python, C#, C++, PowerShell, and memory-resident payloads to evade endpoint detection.

Delivered through Microsoft Teams phishing, the operation uses a convincing fake Windows lock screen to capture credentials before enabling network tunneling and interactive access to compromised enterprise environments.

Compile timestamps and file metadata indicate the toolkit was likely assembled and deployed around July 28, 2026.

The initial access vector relied on Teams-based social engineering. An attacker posing as an internal IT Service Desk representative contacted a target using an @company.onmicrosoft.com address, a Microsoft 365 default tenant domain that can make impersonation attempts appear more credible.

The victim was persuaded to download an MSI package hosted on an Azure Blob Storage endpoint, masquerading as a utility named “PowershellCleaner.”

Once launched, the MSI writes a ZIP archive and PowerShell script into %LocalAppData%\PowershellCleaner\script.

The script uses hidden PowerShell execution, hex character reconstruction, Base64 encoding, AES-CBC encryption, and Invoke-Expression to execute its next stage entirely in memory.

It creates a random 16-character directory beneath %AppData%, extracts its payload, and launches a bundled Python runtime through pythonw.exe.

Shipping a self-contained Python environment allows SynkLoader to operate on systems without a preinstalled Python interpreter.

Its main Python component, ss.py, randomly selects from hardcoded command-and-control infrastructure including neversoftmain[.]net, rootfarmapp[.]net, and tripinupdate[.]net.

It beacons every 90 to 120 seconds using ChaCha20-encrypted JSON traffic, though the operators modified the cipher’s standard Sigma constants. The random installation-directory name doubles as the victim identifier and encryption key.

The loader’s C2 design gives operators a straightforward but powerful execution primitive: it decrypts server responses and passes them directly to Python’s exec function.

This permits arbitrary in-memory Python execution without requiring each subsequent module to be dropped to disk.

Expel Researchers said that, the campaign was first observed on August 18, after an EDR alert flagged a suspicious scheduled task on a customer network. Analysis found no prior public references to the loader or its components.

SynkLoader’s profiling component demonstrates the operators’ focus on enterprise environments.

A malicious DLL named msvcp150.dll, disguised as a Microsoft Visual C++ runtime, exposes PowerShell execution functions to the Python loader.

SynkLoader Malware

The malware then enumerates hostname, username, privileges, processes, services, domain membership, Active Directory computer count, and other system details.

Embedded debug paths reference a developer account named genry, including C:\Users\genry\source\repos\pwshnewdll.

Researchers emulated the C2 protocol and supplied fabricated telemetry suggesting an endpoint belonged to a large Active Directory estate.

The response was rapid: the C2 delivered persistence and credential-phishing modules, followed by tools suited to hands-on-keyboard intrusion.

The rest of the hints appear because the code was designed to simulate the Windows 11 lock screen, but our analysis system runs Windows 10. 

Persistence is implemented through another fake runtime DLL, msvcp160.dll, which manually maps a native DLL into memory.

That payload creates a randomly named scheduled task through the Windows Task Scheduler COM interface rather than schtasks.exe, reducing command-line telemetry and bypassing behavioral detection rules.

The task relaunches the Python loader at user logon and daily at 10 a.m.

The most distinctive payload, dubbed “PhishLocker,” displays a full-screen GUI engineered to mimic the Windows lock screen.

It retrieves the current username and local Windows lock-screen imagery, then presents a password prompt intended to harvest the user’s plaintext password.

Although users can technically bypass the fake screen by entering any value, the visual deception is sufficient to create a high-risk credential-capture opportunity.

Unlike credential dumping tools such as Mimikatz, the technique seeks the raw password rather than an NTLM hash.

That distinction is significant in SSO-enabled environments, where a valid password may unlock VPN, SaaS, internal applications, email, and privileged systems.

SynkLoader also deploys a “TrafficRedirector” reverse-proxy module that establishes outbound connections to attacker infrastructure and forwards traffic toward operator-selected internal or external destinations.

Combined with harvested credentials, this gives attackers a route to access LAN-only services and bypass IP-based allow-listing controls by operating through the victim’s corporate network connection.

Additional modules include an in-memory PowerShell reverse shell and a Python VNC component, “StreamMaster,” capable of streaming the victim’s active desktop and injecting keyboard or mouse input.

The tooling indicates an intended transition from automated foothold establishment to direct operator-driven intrusion.

Defenders should investigate Teams-originated software downloads, unexpected bundled Python runtimes, suspicious pythonw.exe execution from AppData, and scheduled tasks with randomized names.

Network teams should block or hunt for the identified C2 domains and review outbound traffic associated with the described encrypted beacon patterns.

IOCs

Description	IOC Type	IOC
Initial Installer URL (sent via Teams)	URL	https://filereserve.blob.core.windows[.]net/vgnghuyk/331/331.msi
331.msi (Initial Installer)	SHA256	151d2a7f52f047638ca8ad80c859c6bfe04d7510fb10933817fa0e3ba5d07a11
cleaner.ps1 (first stage payload)	SHA256	80f08360ba768b152b71abb1cab557f552a13de18c83fe8e6396a197feec9185
archive6.zip (zip file containing loader + Python)	SHA256	209F69A6CA859F05C954096B30391A43FDA33C9ED264DFDCCF806697F04B06A8
ss.py (Main Loader)	SHA256	D150C70D2732DF17AA77991B9EBF4C896F044445E900978581D9598DFA5DC98C

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide