SynkLoader Malware Spreads Through Microsoft Teams Phishing and Steals Windows Passwords

SynkLoader is a sophisticated malware loader observed in August 2026 that combines Python, C#, and native C++ to evade detection, deploy an embedded Python runtime, harvest plaintext Windows credentials via a fake Windows 11 lock screen (PhishLocker), and provide a backconnect proxy for lateral movement and access to internal resources; initial delivery used a spoofed Microsoft Teams message and an MSI hosted on Azure Blob Storage, with researchers observing C2 domains, scheduled task persistence, and modules suggesting ties to ransomware or initial-access brokers.