SynkLoader malware spreads via Microsoft Teams phishing

A new malware family called SynkLoader has been identified in phishing campaigns that use Microsoft Teams to deliver a fake lock‑screen page and harvest user credentials. Security researchers confirmed the threat after observing several incidents in which victims received Teams invitations that led to the malicious payload.

The campaign targets anyone with a Microsoft Teams account, primarily corporate users who rely on the platform for collaboration. Attackers send a phishing email that appears to be a legitimate Teams meeting invitation. When the recipient clicks the link, a web page mimics a Windows lock screen, prompting the user to enter their username and password. The entered credentials are then sent to the attacker’s server, and the SynkLoader binary is downloaded onto the victim’s machine.

SynkLoader is a Windows‑only executable that runs silently in the background. Its primary function is credential theft, but it can also download additional malicious modules. The malware does not appear to encrypt files or demand ransom, focusing instead on long‑term access to corporate networks.

Users can protect themselves by verifying the sender of any Teams invitation and by checking the URL before entering credentials. Microsoft recommends opening Teams links only from the official Teams client or the Microsoft domain. If a lock‑screen page appears in a browser, it should be treated as suspicious. Updating Windows and anti‑malware software regularly can also block the payload before it executes.

ComputerScams.com offers free tools such as the Malwarebytes Anti-Malware scanner and the Microsoft Safety Scanner to detect and remove threats like SynkLoader. Running a full system scan after a suspected infection can help identify hidden components. Enabling multi‑factor authentication on Microsoft accounts adds an extra layer of protection against stolen passwords.

The incident underscores the importance of password security and cautious email handling. Users should report suspicious Teams invitations to their IT department and avoid entering credentials on any page that does not belong to Microsoft.

Source: Read the original report

Practical tip: Before entering any login information, hover over the link to confirm it points to a microsoft.com domain, and if in doubt, open Teams directly from the official app.