Home / Technology / New SynkLoader malware uses fake IT help desk Teams messages
New SynkLoader malware uses fake IT help desk Teams messages
24 Aug
Summary
- SynkLoader malware spreads via fake IT help desk Teams messages.
- PhishLocker module harvests OS passwords via fake login screens.
- Interactive Shell grants attackers full remote control over devices.
Cybercriminals have been actively distributing a new backdoor malware named SynkLoader for approximately one month. The attack begins with social engineering, where victims receive Microsoft Teams messages from individuals posing as IT help desk staff.
These messages falsely claim computer issues and urge the installation of a "PowerShell Cleaner," which is actually a malicious framework hosted on Microsoft Azure. This malware includes modules for harvesting system information and creating reverse proxies.
Two particularly concerning modules are PhishLocker and Interactive Shell. PhishLocker presents a convincing fake Windows lock screen to capture user OS login passwords. Interactive Shell, on the other hand, allows threat actors to remotely execute PowerShell commands, granting them full control over the compromised device.
To mitigate these threats, organizations should train staff to distrust unsolicited Teams messages and verify application installations with their IT department before proceeding. Employees are often the weakest link in cybersecurity, inadvertently providing attackers access.
