Researchers at Expel spent this month picking apart a malware family they had never seen before. It calls itself, or at least its file names suggest, SynkLoader, and it reaches victims through a channel that a lot of security programs still treat as a lesser concern than the inbox: a direct message inside Microsoft Teams. Expel’s Marcus Hutchins reverse engineered the malware, built a convincing fake corporate network, and let the operators in. They spent the next 24 hours working the machine by hand before they figured out none of it was real. What they revealed about their own tooling in that window is the more interesting part of the story.
The Message Never Passes Through Anyone’s Mail Server
The campaign starts with a Teams message from someone claiming to be IT support, sent from an account with a name like “IT Service Desk” on an address ending in onmicrosoft.com. That domain suffix is not spoofed. Any organization can spin up a Microsoft 365 tenant, free or trial, and its accounts automatically get an onmicrosoft.com address that looks and behaves like a legitimate corporate identity to anyone receiving an external Teams message. The victim is told their system needs a “PowerShell Cleaner” and is walked through installing an MSI package hosted directly on Microsoft Azure, which makes the download itself look trustworthy to anyone glancing at the source.
A Fake Lock Screen Built to Fool the Person, Not the Software
The most striking piece of SynkLoader is a module the researchers named PhishLocker. Once installed, it renders a window that is a near-perfect visual copy of the real Windows lock screen and simply waits for the victim to type their password into it, handing the attacker valid domain credentials without a single exploit or vulnerability involved. From there, SynkLoader deploys a reverse proxy module that lets the attacker reach internal network services through the victim’s machine, a VNC-style module for full remote desktop control, and an interactive shell for running PowerShell commands directly. Built across Python, PowerShell, C#, and C++, it reads less like one tool and more like an attacker’s entire toolkit compressed into a single installer.
Why This One Sits Entirely Outside DMARC’s View
Every layer of protection DMARC, SPF, and DKIM provide exists to answer one question about a message’s From address on the email channel. SynkLoader never asks that question, because it never uses that channel. The initial contact is a Teams chat message, the payload is hosted on Azure infrastructure that belongs to Microsoft, and the credential theft happens inside a native Windows UI element the malware is impersonating, not inside a browser page pointing at a lookalike domain. Compare this to campaigns covered here before that at least started with a phishing email pointing to a fake Teams notification. This one skips that step entirely. The trust cue that gets a victim to click, an onmicrosoft.com sender name inside their own collaboration tool, was never something an email authentication policy could see, verify, or reject.
What This Means for Your Program
Lock down external access in Microsoft Teams to an explicit allow list. The default configuration in many tenants still lets any external onmicrosoft.com account message your users directly. Restricting that to known partner domains closes the exact door SynkLoader walked through.
Tell your staff, explicitly, that IT support does not initiate contact over Teams chat and ask them to install software. The same rule your security awareness training already applies to unsolicited phone calls and emails needs to extend to chat platforms your organization trusts by default.
Teach the Ctrl+Alt+Del test. A genuine Windows lock screen responds to Ctrl+Alt+Delete or Alt+Tab; an application impersonating one usually does not, or behaves oddly when a user tries. It is a fast, memorable check that catches PhishLocker and anything built the same way.
Keep pushing DMARC to reject on every domain you own, and recognize its limits at the same time. Enforcement remains the right move against forged domains in email, which is still the far more common attack. It simply has nothing to say about a threat that never touches a domain you control in the first place.
The Takeaway
The most telling detail in Expel’s research is not the malware’s modular design. It is that the attackers spent an entire day operating inside a network built solely to study them, hands on keyboard, running real commands, because a fake IT support message inside Teams was enough to get them a foothold. Email defenses have gotten good enough that attackers are visibly moving to channels those defenses were never built to cover. DMARC still closes one of the widest and cheapest doors into your organization. It was just never the only door, and SynkLoader is a reminder that the others need attention too.
Excello Mail helps you lock down DMARC, SPF, and DKIM enforcement on every domain you own, closing the forged-domain door that remains one of the cheapest ways into an inbox, so your team can spend more time on the channels DMARC was never built to cover. Sign up for free to Excello Mail and get full visibility into who is sending as your domain.