SynkLoader Uses a Fake Windows Lock Screen to Steal Corporate Passwords

A newly documented malware family called SynkLoader is using Microsoft Teams phishing, a fake IT support tool and a convincing imitation of the Windows lock screen to steal corporate users' login credentials.

Security firm Expel discovered the malware on 18 August 2026 while investigating an endpoint detection and response (EDR) alert involving a suspicious scheduled task on a customer network. File timestamps and compilation dates examined by the researchers suggested that parts of the malware had been created and distributed from around 28 July.

What makes SynkLoader particularly interesting is not simply its password-stealing capability. It is a modular toolkit combining Python, PowerShell, C# and C++, with components for system profiling, persistence, credential phishing, network tunnelling, remote command execution and desktop control.

The attack starts with fake IT support on Microsoft Teams

Expel was unable to recover the complete Microsoft Teams conversation from the original incident, but the available metadata showed someone using an @<company>.onmicrosoft.com Microsoft 365 address contacting the victim under the name IT Service Desk.

The victim was persuaded to download and install an MSI package presented as a utility called PowershellCleaner, or “PowerShell Cleaner”. The file was hosted on Microsoft Azure Blob Storage, giving the download a Microsoft-associated domain that could make it appear more trustworthy at a glance.

Once executed, the installer extracts a ZIP archive and a PowerShell script named cleaner.ps1. The PowerShell stage executes further code in memory and creates a randomly named directory beneath the user's AppData\Roaming directory.

SynkLoader then unpacks its own stripped-down Python environment. This is necessary because Windows does not include Python by default. Its main loader, ss.py, is launched using the bundled pythonw.exe executable.

Why it is called SynkLoader

Expel named the malware SynkLoader, pronounced “sink loader”, because of what the researchers described as an “everything but the kitchen sink” approach to malware development.

Its components cross several programming languages, including PowerShell, Python, C# and C++, with some individual stages moving through several languages before completing a task.

The architecture is more than an exercise in complexity. Parts of the chain execute PowerShell and DLL code directly in memory, reducing the amount of malicious material written to disk. One component uses CPython to load a native DLL that can manually map additional DLLs into memory, which can make conventional file-based detection and forensic recovery more difficult.

The main Python loader communicates with one of three hard-coded command-and-control servers. It normally checks in every 90 to 120 seconds and encrypts its communications using a modified implementation of the ChaCha20 cipher.

PhishLocker creates a fake Windows lock screen

The most unusual component recovered by Expel is called PhishLocker.

Rather than directing the victim to a phishing website, PhishLocker creates a full-screen borderless application designed to resemble the Windows lock screen. It obtains the logged-in user's name and selects a lock-screen image from Windows' own C:\Windows\Web\Screen directory, helping the imitation blend into the operating system.

The interface was designed to resemble Windows 11 closely enough that a user returning to their computer could reasonably believe that Windows had locked normally and was asking them to sign in again.

The password entered into this imitation prompt can then be captured by the attacker. This gives the operator the user's actual password rather than merely a password hash, which can be considerably more useful when attempting to access other corporate services or move laterally through a network.

This becomes particularly significant in organisations where the same identity is used across Windows and Single Sign-On services.

The fake lock screen is not perfect

There are ways to distinguish PhishLocker from a genuine Windows lock screen.

Expel found that pressing Alt+Tab still displays the Windows task switcher over the fake screen. That should not normally be possible while Windows is genuinely locked. The malicious application automatically brings itself back into focus, however, so Alt+Tab should be regarded as a useful warning sign rather than a reliable way of closing the program.

The researchers also noticed that the fake interface lacked the normal background blur when its password field was selected.

More unusually, PhishLocker does not appear to check whether the entered Windows password is actually correct. Entering arbitrary text is therefore enough to get past the imitation prompt. A genuine Windows lock screen would reject an incorrect password.

The malware profiles the corporate network first

SynkLoader does not immediately deploy every capability available to it. One of its early modules profiles the infected computer and its surrounding environment.

Information collected can include the hostname, logged-in user, privilege level, running processes, installed services, Windows system information, Active Directory domain and the number of computers found in Active Directory.

That last measurement became particularly significant during Expel's investigation.

To study what the operators would do next, the researchers built an emulator that reproduced SynkLoader's command-and-control protocol without allowing commands to execute against a real corporate environment. They modified the information returned to the attackers so that the machine appeared to belong to an Active Directory environment containing several thousand systems.

The response provided a rare opportunity to observe how a human operator used the malware after initial infection.

A human operator took the bait

After the researchers' emulator reported that SynkLoader's persistence mechanism had been installed successfully, the command-and-control server remained largely quiet for more than 12 hours.

The following morning, the operators began sending a series of additional modules to the simulated victim. The activity suggested that the machine had been selected for interactive, hands-on-keyboard exploitation rather than being left to an entirely automated process.

The recovered tooling included:

• System profiler: collects system, user, privilege, process, service, domain and Active Directory information.
• Persistence module: creates a randomly named Windows scheduled task that launches SynkLoader when the user logs on and again at 10:00 each day.
• PhishLocker: displays the fake Windows lock screen and attempts to collect the user's password.
• TrafficRedirector: creates a backconnect proxy through the compromised machine.
• Interactive shell: provides remote PowerShell command execution.
• StreamMaster: provides VNC-like desktop viewing together with remote mouse and keyboard input.
• Module status script: reports which malware components and associated threads are currently running.

The persistence mechanism is also notable. Rather than invoking schtasks.exe from a command line, SynkLoader uses Windows' Component Object Model (COM) interfaces to create its scheduled task. This can avoid some behavioural detections that look specifically for suspicious Task Scheduler command-line activity.

TrafficRedirector makes stolen credentials more useful

SynkLoader's TrafficRedirector module creates a backconnect proxy between the compromised computer and attacker-controlled infrastructure.

That gives an operator two useful options. They can reach services on the victim's internal corporate network that are not directly exposed to the internet, or they can make connections to external services through the victim's existing corporate internet connection.

Used alongside credentials captured by PhishLocker, this could allow an attacker to authenticate to services while appearing to originate from the compromised organisation's own network.

This matters in environments that rely on IP allow-lists or security monitoring that treats unfamiliar countries, networks or source addresses as indicators of suspicious login activity.

Remote control capabilities go beyond password theft

SynkLoader also includes an interactive shell capable of receiving PowerShell commands from its operators and returning the results.

A separate module called StreamMaster behaves as a VNC server and streams screenshots of the victim's current desktop session while accepting mouse and keyboard input.

It is not a hidden VNC implementation running on an invisible secondary desktop. The operator would be interacting with the user's active session, meaning unexplained mouse movement or keyboard input could expose the intrusion.

When Expel subsequently emulated the interactive shell, the operator attempted several further reconnaissance commands before apparently recognising that the environment was not genuine and disconnecting.

Is SynkLoader connected to ransomware?

That remains uncertain.

Expel was unable to determine the attackers' ultimate objective or attribute the malware to a known threat group. However, the system profiler specifically counts computers in Active Directory, a measurement that can help an attacker judge the size and potential value of a corporate network.

On that basis, together with similarities to loaders previously associated with financially motivated attacks, Expel assessed with low-to-medium confidence that SynkLoader could belong to a ransomware operator or to an initial-access broker that compromises organisations and sells that access to ransomware groups.

That assessment should not be confused with confirmed attribution. No ransomware deployment was observed during the investigation.

How users can recognise the attack

The strongest defence comes before SynkLoader is ever installed. Unexpected Microsoft Teams messages claiming to come from internal IT should be verified through a known internal channel, particularly when the sender asks a user to download software or run an installer.

A Microsoft-hosted domain is not proof that a file is legitimate. Cloud storage services such as Azure Blob Storage can host attacker-controlled content just as they can host legitimate business files.

If a Windows lock screen appears unexpectedly, several signs associated with the version examined by Expel may indicate something is wrong:

• Pressing Alt+Tab causes the task switcher to appear over the supposed lock screen.
• The background does not blur in the same way as a genuine Windows 11 password prompt.
• The screen accepts an incorrect or arbitrary password rather than rejecting it.

If any of these behaviours occur on a managed corporate device, users should stop entering credentials and contact their security or IT team through an established channel.

What security teams should watch for

Organisations can reduce exposure by restricting the installation of unapproved MSI packages and monitoring unusual combinations of PowerShell, Python and user-writable directories.

Particular attention may be warranted when pythonw.exe is launched from an unexpected directory beneath a user's AppData folder, especially on machines where Python is not part of the approved software estate.

Defenders should also investigate unusual scheduled tasks, suspicious PowerShell execution in user contexts and unexpected outbound connections associated with newly created directories or bundled runtime environments.

The incident is also another reminder that trusted collaboration platforms are now part of the phishing attack surface. A message arriving through Microsoft Teams, and a download being hosted on Microsoft infrastructure, do not by themselves establish that either is trustworthy.