New SynkLoader Malware Uses Fake Windows Lock Screen to Steal Passwords and Pivot Networks

SynkLoader is a newly identified, modular malware framework deployed via Microsoft Teams phishing that uses a fake Windows lock screen to harvest plaintext credentials, in-memory Python/C#/C++/PowerShell components to evade detection, scheduled-task persistence, reverse-proxy tunneling to access internal resources, and remote-interaction tools (VNC, reverse shells). The report provides technical behavior, compilation metadata suggesting late July 2026 activity, C2 domains, and multiple IOCs (MSI URL and SHA256 hashes) for detection and mitigation.