SynkLoader Mimic as IT Support Personnel Attacking Users Via Microsoft Teams

SynkLoader is using Microsoft Teams conversations to turn routine IT support requests into a route for malware delivery.

The campaign relies on impersonation rather than a software flaw, placing the decision to install a supposed fix directly in front of an employee.

Attackers contact targets through Teams messages and voice phishing, also called vishing, while posing as support personnel.

They persuade victims to download a fraudulent MSI installer called “PowerShell Cleaner,” making a familiar workplace channel part of the attack chain.

Analysts from ReliaQuest Threat Research identified SynkLoader as a hash-gated PowerShell loader. The threat is notable because it combines a convincing social approach with code designed to reveal little when researchers or automated tools inspect it.

ReliaQuest Threat Research said in a report shared with Cyber Security News (CSN) that the operation can slip past controls that focus mainly on email attachments or obvious malicious websites.

By using legitimate Azure Blob Storage for delivery and keeping key activity in memory, it can make a harmful download look less suspicious while reducing the traces left for defenders.

SynkLoader Mimic as IT Support Personnel

The opening move is simple: a message or call that appears to come from an internal IT worker. The attacker offers help, often framing the installer as a cleaner or repair tool, much like the Teams helpdesk impersonation attacks that have used familiar support language to win trust.

The victim is directed to an MSI file hosted in Azure Blob Storage. Cloud hosting is not malicious by itself, but its presence can give a download an air of legitimacy.

Once launched, the fake installer starts the loader and begins the next stage without relying on an email attachment.

The delivery path can begin with either vishing or Teams messages, but both routes lead to the same deceptive installer. That pattern matters because staff may be trained to question email links yet treat Teams as a trusted space.

Recent reporting on a two-minute Teams call shows how quickly a brief support-themed interaction can become an entry point when attackers create urgency and offer an easy fix.

Loader Hides Its Next Stage

After installation, SynkLoader decrypts its payload in memory and checks the payload’s cryptographic hash before running it. If the file has been changed or extracted incorrectly, it stops quietly. This check can frustrate automated analysis because a sandbox may never see the full infection sequence.

The loader then deploys a Python backdoor that collects its working features from command-and-control infrastructure when needed.

Keeping those capabilities outside the first file limits what can be learned from a static inspection and may leave the backdoor appearing dormant if its servers are unavailable.

This approach reflects the wider abuse of scripting tools in attacks. In other cases, PowerShell evasion techniques have helped criminals run code with fewer visible files, making unusual script activity a useful warning sign rather than proof of a harmless maintenance task.

The design also creates an investigation gap. A file may look incomplete, or harmless, when analysts cannot reproduce the expected conditions.

That is why teams should preserve the installer, review process and network logs, and search for related activity instead of clearing an alert after one failed execution.

Similar Python loader attack chains show why both scripting engines deserve attention during incident response. This helps prevent one missed detail from obscuring the incident.

Organizations should limit unnecessary external Teams communications and require employees to independently confirm unexpected support requests through a known channel.

Security teams should watch for MSI files launched from user-controlled folders or cloud-storage links, and for unusual PowerShell or Python activity.

Any device that ran the fraudulent installer should be isolated and examined for follow-on payloads and command-and-control traffic.

The central lesson is practical: a trusted platform and a familiar support story do not make a download safe. Verification before installation remains the strongest first defense.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	d150c70d2732df17aa77991b9ebf4c896f044445e900978581d9598dfa5dc98	SHA-256 hash associated with SynkLoader activity
File name	ss[.]py	Python backdoor deployed by SynkLoader
Domain	neversoftmain[.]net	Domain listed as an IoC in the reported campaign
Domain	rootfarmapp[.]net	Domain listed as an IoC in the reported campaign
Domain	tripinupdate[.]net	Domain listed as an IoC in the reported campaign

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC