SynkLoader is a newly identified modular Windows malware family that turns a simple helpdesk impersonation into a full access chain. The operator can profile a host, create persistence, steal a user’s Windows password, proxy traffic through the infected system, run PowerShell commands, and take remote control of the active desktop. Much of the follow-on code runs in memory, and the loader crosses several programming languages during execution.
Expel found the malware on August 18, 2026, during an incident in which endpoint detection alerted on a scheduled task. File and compilation timestamps suggested that parts of the toolset were first built and distributed around July 28. Expel named it SynkLoader, pronounced “Sink Loader,” due to the number of languages, loaders, DLLs, and follow-on modules used in one chain.
Later reporting added more evidence that this was not a single delivery attempt. ReliaQuest reported SynkLoader activity tied to both Microsoft Teams messages and voice phishing that impersonated IT support. The observed chains still led users to a fraudulent “PowerShell Cleaner” MSI package hosted on Azure Blob Storage.
The malware does not need a software exploit to enter the environment. It uses the user’s trust in internal support workflows. That makes the initial access method as important as the code that runs after installation.
The Attack Starts in Microsoft Teams
In the incident studied by Expel, an attacker contacted the target through Microsoft Teams and used the display name “IT Service Desk.” The account used an onmicrosoft.com address from a Microsoft 365 tenant. The attacker convinced the user to download an MSI package from a Microsoft Azure storage endpoint. The package called itself “PowerShell Cleaner.”
This delivery method gives the attack two forms of borrowed trust. The first is the support identity presented in Teams. The second is the Microsoft-hosted storage location used for the download. Neither item proves that content is safe, but both can reduce user suspicion.
Microsoft has reported the same broad social-engineering pattern in other 2026 intrusions. Its incident response teams documented cross-tenant Teams contacts in which attackers posed as helpdesk staff and moved victims from a support conversation into remote access, credential theft, and later hands-on activity. Microsoft also notes that Teams can show external-contact labels, Accept or Block prompts, phishing warnings, and Safe Links controls. These controls help, but the user can still approve the interaction and run attacker-supplied software.
SynkLoader fits this pattern. The attacker does not start with a memory corruption flaw or an exposed service. The attacker starts with a support request that looks routine.
The Fake PowerShell Cleaner Starts the Loader
The MSI writes files under %LocalAppData%\PowershellCleaner\script. The files include cleaner.ps1 and archive6.zip. The installer then starts the PowerShell script.
The first PowerShell stage starts a hidden PowerShell window. It builds a command from encoded values and passes the result to Invoke-Expression. That command contains Base64 data that is encrypted with AES-CBC. After decryption, the script builds a PowerShell script block and runs it in memory. Expel found that later PowerShell content did not need to be written to disk.
The decrypted script creates a random 16-character directory under %AppData%. It then extracts the ZIP file into a nested fl\ang path. The archive carries its own Python runtime, malicious Python code, precompiled libraries, and DLL files that use names similar to Microsoft Visual C++ runtime files. Windows does not include Python by default, so the attacker ships the interpreter with the malware.
This choice removes a dependency that could stop the attack. The target does not need a local Python installation. The attacker controls the Python version, libraries, and execution path.
The main loader is ss.py. The script runs through the bundled pythonw.exe, which lets the process run without a normal console window. The random 16-character installation directory also becomes the victim identifier for later command-and-control traffic.
Command and Control Is Small but Flexible
The Python loader contains three hardcoded command-and-control domains: neversoftmain[.]net, rootfarmapp[.]net, and tripinupdate[.]net. It selects one domain at random and checks in every 90 to 120 seconds.
The C2 traffic uses a modified ChaCha20 implementation. SynkLoader replaces the normal ChaCha20 constant strings with custom values and uses the victim identifier as the key. The server response is decrypted and passed to Python exec, so the C2 server can send Python code for direct in-memory execution.
This design keeps the core loader small. The first file does not need to contain every later capability. The operator can select a module after the host checks in.
ReliaQuest later described a related hash-validation step. Its reporting said the loader checks a cryptographic hash before it runs a decrypted payload. A changed or damaged payload can cause execution to stop without an obvious error. ReliaQuest also reported that ss.py retrieves capabilities from C2 at runtime instead of storing them all in the first-stage file. That behavior can reduce what static analysis or a short sandbox run can see.
SynkLoader Uses Several Languages to Reduce the Detection Surface
One of the most unusual parts of SynkLoader is the way its modules cross language boundaries. Python starts C# or native DLL code. That code can start PowerShell in memory. A later native DLL can manually map another DLL into memory.
The system profiler shows this pattern. It uses a file named msvcp150.dll. The name resembles a Microsoft Visual C++ runtime library, but Expel found that the file is a custom C# module. It exports functions named RunPowerShell and RunPowerShellW. These functions create a PowerShell object in memory and run caller-supplied commands. Python loads the DLL through CPython and calls those functions directly.
The result is an execution path that can look less direct than a standard malicious PowerShell process tree. PowerShell capability is present, but a defender cannot rely only on searches for powershell.exe with suspicious command-line text. MITRE ATT&CK notes that PowerShell can run through the underlying System.Management.Automation components without direct use of the normal PowerShell executable.
This is a key design feature of SynkLoader. The operator uses Python as an orchestration layer, then moves work into DLLs and in-memory PowerShell. That gives the malware several places to hide execution from controls that inspect only one interpreter, one file type, or one process pattern.
The System Profiler Helps the Operator Judge the Victim
The first follow-on module collected detailed host and domain data. Expel observed collection of the hostname, logged-on user, privilege level, Active Directory domain, running processes, installed services, system information, and the number of computer objects found through Active Directory.
The Active Directory computer count is of special interest. It gives an operator a fast estimate of the size of the Windows estate. A larger domain can suggest more systems, more lateral movement paths, and a larger operational impact if the attacker later deploys ransomware or another disruptive payload.
Expel used this profiling behavior to attract more activity. Researchers modified the system data returned to the C2 and made the test host appear to belong to an Active Directory environment with several thousand computers. The C2 then sent new modules, including persistence and credential-phishing components. More than 12 hours later, the operator sent another group of tools that supported interactive access.
That delay matters. It suggests that at least part of the observed workflow included human selection after automated host profiling. SynkLoader can act as a loader, but the intrusion can move into operator-controlled activity after a target appears valuable.
Persistence Avoids the Normal schtasks Command Line
The persistence module adds another layer. Python loads msvcp160.dll, which is a native manual DLL loader. That DLL can map another DLL into memory and call one of its exported functions. The follow-on DLL does not need to be written to disk.
The persistence DLL creates a Windows scheduled task through the Task Scheduler COM interface. It does not need to call schtasks.exe. Expel reported that the DLL uses the Task Scheduler COM provider and related interfaces to register the task. This removes a common command-line artifact that many detections use.
The task gets a random 12-character alphanumeric name. It starts ss.py through the bundled pythonw.exe. It has two triggers: user logon and 10 a.m. local time each day. The logon trigger restores the loader after a reboot or logoff. Expel did not determine the reason for the daily 10 a.m. trigger.
This technique maps closely to MITRE ATT&CK T1053.005, Scheduled Task. MITRE notes that attackers can create tasks through API-based methods and other interfaces, so defenders should detect task creation itself instead of looking only for the schtasks utility. Microsoft Security Event 4698 records scheduled task creation when the required auditing is enabled.
PhishLocker Steals the Password From a Fake Windows Lock Screen
PhishLocker is the most distinctive SynkLoader module found in the Expel investigation. It does not dump credentials from LSASS. It asks the user to type the password into a fake Windows lock screen.
The module gets the current username and reads the system lock-screen image from C:\Windows\Web\Screen. It then draws a full-screen borderless window that closely copies the Windows 11 lock screen. The program keeps focus on itself to make it harder for the user to move to another window.
The fake screen has weaknesses. Expel found that Alt+Tab can still display the real application switcher. The fake interface also lacked the normal background blur seen when the Windows password field has focus. The test system ran Windows 10, so some Windows 11 layout details also looked wrong.
The module does not validate the password against Windows. Any text can dismiss the fake screen. The value lies in what the user types, not in whether Windows accepts it.
This behavior is a direct example of GUI input capture. MITRE ATT&CK T1056.002 covers fake operating-system or application prompts that collect credentials from user input.
The raw password has clear value in an enterprise network. A password can work with SSO-backed applications, VPN services, remote access systems, or Windows authentication paths, depending on the organization’s identity design. It can also be more useful than a password hash in systems that do not accept pass-the-hash techniques.
TrafficRedirector Makes the Stolen Credential More Useful
Credential theft is only part of the problem. SynkLoader also contains a custom module named TrafficRedirector. Expel describes it as a backconnect proxy with behavior similar to HTTP CONNECT. The infected system makes the outbound connection to attacker infrastructure. The operator can then tell the module which IP address and port to reach. Traffic is forwarded through the victim host.
This gives the operator two major access paths. The attacker can reach internal services that are accessible from the victim’s local network. The attacker can also reach external services through the victim’s public network address. In that case, a login can appear to come from the same company network or expected source range as normal user traffic.
The combination of PhishLocker and TrafficRedirector is more serious than either component by itself. One module can collect a user credential. The other can provide network context that makes later use of that credential look less unusual.
IP allow lists, geolocation rules, and unfamiliar-source alerts can lose value in this case. The attacker can route traffic through the compromised endpoint instead of connecting from obvious attacker infrastructure.
MITRE ATT&CK T1090 covers the use of proxies to route attacker traffic through trusted communication paths or compromised systems.
The Interactive Shell Gives the Operator Hands-On Access
SynkLoader also delivered an interactive shell module. This component uses the RunPowerShell function from the malicious msvcp150.dll file. It polls a C2 endpoint for commands, runs those commands through in-memory PowerShell, and sends the output back through a separate endpoint.
This module changes the intrusion from automated staging into remote operator access. The attacker can issue commands based on what is present in the environment. That makes detection based on a fixed list of follow-on commands less reliable.
Expel later emulated this reverse-shell protocol. The operator sent several profiling commands, then disconnected after recognizing that the target was not a real corporate network.
The observed activity supports the view that SynkLoader is built for human-operated intrusions. The loader gets the operator into the endpoint, profiles the environment, and supplies tools for the next phase.
StreamMaster Adds Remote Desktop Control
Another module, called StreamMaster, acts as a Python-based VNC server. It does not listen for inbound connections in the normal VNC model. It connects outward to attacker infrastructure.
The module captures screenshots from the current user session, compresses them with zlib, and sends them to the operator. It can also pass mouse and keyboard input into the active desktop. It is not a hidden VNC implementation. The user can see input and screen changes, so active use can expose the intrusion.
Expel found extensive comments in the VNC code. The comments used formal language and did not match an identified open-source project. Expel suspected that AI coding tools might have helped produce the module. That is an analyst assessment, not proven authorship evidence.
The operator also sent a small status-checking script after some modules failed in Expel’s emulated environment. The script reported which module threads were alive. This gives another sign of active troubleshooting by a human operator.
Harder to Detect as a Chain Than as a File
No single SynkLoader technique is new on its own. The defensive problem comes from how the pieces are joined.
The first contact arrives through a business collaboration platform. The installer is hosted on legitimate cloud infrastructure. PowerShell content moves into memory. Python is shipped with the malware, so the target does not need a local interpreter. Python then calls C# and native DLL code. A DLL manually maps another DLL. The scheduled task is created through COM instead of a common command-line tool. Later modules arrive from C2 only after the host has been profiled.
This structure can weaken controls that inspect events in isolation. A cloud-hosted MSI may not look malicious from the URL alone. A Python process may appear unusual but not decisive. A random scheduled task can be missed if analysts search only for schtasks.exe. A user login from a known corporate IP can appear normal after the attacker routes the session through TrafficRedirector.
The better detection model is correlation. The question is not whether one event proves SynkLoader. The question is whether several unusual events occur in a sequence that matches the intrusion.
MITRE ATT&CK provides useful categories for several observed actions. Teams-based delivery aligns with T1566.003, Spearphishing via Service. Python execution aligns with T1059.006. In-memory DLL loading can align with T1620, Reflective Code Loading. Scheduled-task persistence aligns with T1053.005. Fake credential prompts align with T1056.002. Proxy activity aligns with T1090.
What Security Teams Should Search For
Detection should begin at the social and endpoint layers at the same time. An external Teams contact that claims to be internal IT should have low trust until the user verifies it through an approved support path. Microsoft recommends review of external sender identity and provides controls for suspicious external chats, URL inspection, and Defender-based protection for Teams.
On the endpoint, defenders can hunt for MSI execution followed by creation of %LocalAppData%\PowershellCleaner\script\cleaner.ps1 or archive6.zip. They can also look for pythonw.exe running from a random directory under %AppData%, with ss.py in the nested fl\ang path. These path combinations are much more useful than a generic alert for Python.
Scheduled-task telemetry also matters. SynkLoader used a random task name, so the name itself is weak. The stronger signal is a new task that starts a bundled pythonw.exe from a user profile and points to ss.py. Event 4698 can record the task definition when the audit policy is active. The task content can then be correlated with process, file, and network events.
Network hunting should include the known C2 domains from the first observed campaign: neversoftmain[.]net, rootfarmapp[.]net, and tripinupdate[.]net. Expel also identified dondermicapp[.]net for TrafficRedirector and aroclenetapp[.]net for the VNC module. These indicators are useful for historical searches, but they should not be the only detection layer. Infrastructure can change faster than the behavior of the loader.
ReliaQuest recommended monitoring unusual MSI execution from cloud-storage URLs and user-controlled directories, along with suspicious PowerShell or Python activity. It also recommended isolating systems that ran the fraudulent installer and checking them for later payloads and C2 activity.
Response Must Treat the Password as Compromised
A host that displays the PhishLocker screen needs more than malware removal. If a user entered a real password, the incident includes credential exposure.
Response teams should isolate the endpoint, reset the affected credential, revoke relevant sessions, review MFA registrations, and examine authentication logs for activity that used the same account. They should also review internal services that accepted the account after the first SynkLoader execution.
TrafficRedirector changes how that log review should work. Analysts cannot assume that a familiar source IP means the login was legitimate. A malicious session can pass through the infected workstation. Identity telemetry, device state, session timing, target resources, and endpoint network activity need to be reviewed together.
The same logic applies to lateral movement. A successful login from the user’s normal network can still be hostile if it appears after credential capture and proxy activation.
The Ransomware Link Is Plausible, but It Is Not Proven
Expel did not identify the operator or final objective. The researchers assessed with low-to-medium confidence that the toolkit could belong to a ransomware group or an initial access broker that sells access to ransomware operators. Their reasoning included the loader’s access-focused design and the system profiler’s interest in Active Directory size.
That assessment is plausible, but the available evidence does not prove a ransomware connection. Many human-operated intrusion groups value domain size, valid credentials, remote shell access, and proxy capability. No ransomware payload was observed in the Expel investigation.
The safer conclusion is that SynkLoader is an access platform built to place an operator inside an enterprise network and give that operator several ways to continue. The final action can depend on who runs the tool or who receives the access.
Why SynkLoader Matters
SynkLoader shows how enterprise intrusion chains are moving deeper into tools and workflows that users already trust. The first message can arrive through Teams. The download can come from Azure storage. The malware can use Windows scripting, a bundled Python runtime, fake Microsoft-style DLL names, COM interfaces, and in-memory execution. Later access can use the victim’s real password and the victim’s own network path.
For defenders, the lesson is direct. Trust signals cannot be evaluated one at a time. A Microsoft domain does not make a file safe. A Teams support message does not make the sender internal. A familiar login IP does not prove that the real user made the connection.
SynkLoader is most visible when defenders connect identity, collaboration, endpoint, task-scheduler, process, file, and network telemetry. That cross-source view can expose the full sequence from helpdesk impersonation to remote access.
The malware is still new, and its operator has not been identified. Its known modules already show a clear design goal: get a user to run the first stage, keep later code off disk where possible, steal a credential without classic dumping tools, and give a human operator a path into the rest of the network.
How Can Netizen Help?
Founded in 2013, Netizen is an award-winning technology firm that develops and leverages cutting-edge solutions to create a more secure, integrated, and automated digital environment for government, defense, and commercial clients worldwide. Our innovative solutions transform complex cybersecurity and technology challenges into strategic advantages by delivering mission-critical capabilities that safeguard and optimize clients’ digital infrastructure. One example of this is our popular “CISO-as-a-Service” offering that enables organizations of any size to access executive level cybersecurity expertise at a fraction of the cost of hiring internally.
Netizen also operates a state-of-the-art 24x7x365 Security Operations Center (SOC) that delivers comprehensive cybersecurity monitoring solutions for defense, government, and commercial clients. Our service portfolio includes cybersecurity assessments and advisory, hosted SIEM and EDR/XDR solutions, software assurance, penetration testing, cybersecurity engineering, and compliance audit support. We specialize in serving organizations that operate within some of the world’s most highly sensitive and tightly regulated environments where unwavering security, strict compliance, technical excellence, and operational maturity are non-negotiable requirements. Our proven track record in these domains positions us as the premier trusted partner for organizations where technology reliability and security cannot be compromised.
Netizen holds ISO 27001, ISO 9001, ISO 20000-1, and CMMI Level III SVC registrations demonstrating the maturity of our operations. We are a proud Service-Disabled Veteran-Owned Small Business (SDVOSB) certified by U.S. Small Business Administration (SBA) that has been named multiple times to the Inc. 5000 and Vet 100 lists of the most successful and fastest-growing private companies in the nation. Netizen has also been named a national “Best Workplace” by Inc. Magazine, a multiple awardee of the U.S. Department of Labor HIRE Vets Platinum Medallion for veteran hiring and retention, the Lehigh Valley Business of the Year and Veteran-Owned Business of the Year, and the recipient of dozens of other awards and accolades for innovation, community support, working environment, and growth.
Looking for expert guidance to secure, automate, and streamline your IT infrastructure and operations? Start the conversation today.
Netizen Blog and News 
Leave a comment