A new malware family called SynkLoader is being pushed through Microsoft Teams phishing campaigns, according to BleepingComputer, which cites analysis from Expel security researcher Marcus Hutchins. The reported goal is credential theft: the malware presents a fake lock screen designed to capture the victim’s Windows account password. The campaign, as described by BleepingComputer, starts with an attacker impersonating the target company’s IT help desk. The victim is directed to install a fake “PowerShell Cleaner” executable packaged as an MSI installer. Expel said the download was hosted in Microsoft Azure, a detail that can make the file appear more trustworthy to a user being socially engineered through a workplace channel. BleepingComputer reports that SynkLoader appears to be a previously unknown malware family. Expel’s analysis found compile dates and file timestamps indicating the malware was first compiled and distributed around July 28, 2026. The report does not establish the size of the campaign or identify the organizations targeted. The installer’s internal structure is notable because SynkLoader mixes several technologies. According to the report, the MSI extracts a PowerShell script named cleaner.ps1 and a ZIP archive containing the Python framework, a malicious Python script, precompiled Python libraries, and fake Microsoft runtime dynamic-link libraries. Expel said attackers can choose which modules to deploy based on the breached environment’s profile and operational targets. BleepingComputer says the malware was named SynkLoader because of its unusual combination of Python, PowerShell, C#, and C++, sometimes using as many as three programming languages inside one module. That architecture matters for defenders because detection may not hinge on a single executable or scripting language. Expel also noted that hashes for SynkLoader modules are unique per infection, which makes hash-based indicators less useful than behavioral detection and user-verification controls. The most important component described in the report is PhishLocker, a module that attempts to obtain the Windows account password through a fake lock screen. BleepingComputer says the fake screen is convincing, but Expel observed that it is still a full-screen borderless graphical application: using Alt+Tab can reveal the active windows on top of it. The report also recommends Ctrl+Alt+Delete as a way to test whether an unexpected lock screen is authentic. The credential-theft path is more serious than a simple phishing prompt because the password could be paired with a tunneling module to access a corporate environment from the infected device, according to BleepingComputer’s account of the analysis. That could help attackers work from a machine that already sits inside an allowed network path, potentially bypassing IP allow-list restrictions. Hutchins also said SynkLoader’s focus on measuring Active Directory environment size makes it likely that the malware is being used in ransomware operations. He said Expel wrote an emulator for the reverse-shell module to confirm whether the activity involved hands-on-keyboard control; the actor reportedly ran several profiling commands before realizing the environment was not real and disconnecting. For operators, the immediate defensive message is narrow but concrete: independently verify unexpected IT requests and do not install unsolicited MSI files, even when the file appears to be hosted on a familiar cloud platform. For users who encounter an unexpected lock screen after a suspicious install, Expel’s reported guidance is to test it with Ctrl+Alt+Delete or Alt+Tab rather than entering credentials blindly. Who benefits: Security teams benefit from treating unsolicited IT support requests in Teams as a first-class phishing vector, not just an email problem. Behavioral detections around unexpected MSI execution, PowerShell scripts, Python payloads, and fake lock-screen behavior may be more useful than static hashes in this case. Who's exposed: Organizations that rely heavily on Teams for internal IT support workflows are exposed to convincing impersonation attempts. Environments that depend on IP allow-listing may also face risk if attackers can operate through a compromised internal device using valid credentials.