New SynkLoader malware pushed in Microsoft Teams phishing campaign

**Executive summary:** Expel researchers identified SynkLoader, a multi-language malware family distributed through Microsoft Teams phishing that tricks victims into installing a fake "PowerShell Cleaner" MSI hosted in Azure; SynkLoader deploys modules for system profiling, persistence, a PhishLocker fake Windows lock screen to harvest credentials, reverse-proxy tunneling for internal access, an interactive PowerShell shell, and VNC-like desktop streaming, and is likely used to support ransomware operations—defenders should verify IT requests, avoid unsolicited MSIs, and use Ctrl+Alt+Delete or Alt+Tab to detect fake lock screens while leveraging provided IoCs.