New SynkLoader malware uses fake Windows lock screen to steal passwords

A new malware family dubbed SynkLoader uses a fake Windows lock screen to steal users’ login passwords before giving attackers remote access to corporate networks.

The modular malware combines Python, PowerShell, C#, and C++ components, with many payloads executed only in memory to reduce detection. The name SynkLoader, pronounced “Sink Loader,” was chosen because of the malware’s unusually complicated collection of components spanning several programming languages.

Expel discovered the malware while investigating an EDR alert involving a suspicious scheduled task on a customer network. Expel researcher Marcus Hutchins said timestamps indicate the malware was first compiled and distributed around July 28, 2026. Researchers reverse-engineered its command-and-control (C2) protocol and built an emulator that posed as a system connected to a large corporate Active Directory environment, convincing the attackers to deploy additional tools.

The observed attack began with Microsoft Teams phishing, where an attacker impersonating an “IT Service Desk” contacted an employee from an onmicrosoft.com account. The victim was convinced to download an MSI package hosted on Microsoft Azure Blob Storage and presented as a tool called PowershellCleaner.

Once installed, the package extracted cleaner.ps1 and archive6.zip. The PowerShell script decoded and decrypted additional commands in memory before unpacking a self-contained Python environment into a randomly named AppData directory and launching the main ss.py loader through pythonw.exe.

SynkLoader communicates with C2, encrypting traffic with a modified ChaCha20 implementation. The server can return Python code that the loader executes directly in memory.

One profiling component abuses a malicious DLL named msvcp150.dll, masquerading as a Microsoft Visual C++ runtime library, to execute PowerShell commands. It collects the hostname, username, privilege level, running processes, services, Active Directory domain, and number of domain-connected computers.

After Expel supplied fabricated data describing a network containing thousands of systems, the attackers delivered additional modules, including persistence tooling, a reverse shell, a VNC-style remote-control component called StreamMaster, and a backconnect proxy named TrafficRedirector.

The most unusual component, dubbed PhishLocker, displays a borderless, full-screen interface that closely resembles the Windows 11 lock screen. It retrieves the current username and Windows lock-screen background, then presents a password field intended to capture the user's real login credentials. Unlike an actual Windows lock screen, however, it accepts any password and can expose an Alt+Tab interface before automatically regaining focus.

TrafficRedirector can then route attacker connections through the compromised computer, allowing access to internal services or externally protected systems from the victim's trusted IP address. Combined with a stolen Windows password, this could facilitate lateral movement while avoiding alerts caused by unfamiliar locations.

Expel assesses with low-to-medium confidence that SynkLoader may be associated with ransomware operators or an initial-access broker.

Organizations can reduce exposure by restricting unsolicited Teams messages, blocking unapproved MSI execution, monitoring unusual pythonw.exe and PowerShell activity, and investigating randomly named scheduled tasks. Users confronted with an unexpected Windows login prompt should avoid entering credentials, particularly if Alt+Tab remains available.