Tricky 'SynkLoader' Multitool May Herald Ransomware

Researchers discovered SynkLoader, a sophisticated malware loader delivered via a phishing campaign that abuses a malicious Microsoft 365 tenant and an Azure-hosted installer; it deploys an in-memory PowerShell loader, a bundled Python environment, multiple native DLL modules (system profiler, persistence via COM, RAT, reverse proxy) and a GUI-based 'PhishLocker' that emulates the Windows login screen to harvest credentials, and is assessed as likely enabling follow-on ransomware or lateral movement by initial access brokers.