What to know

• SynkLoader is a new modular malware loader first compiled in late July 2026, distributed via Microsoft Teams phishing impersonating IT helpdesk staff.
• The malware creates a fake Windows lock screen to steal login credentials and includes a network tunneling module enabling lateral movement across company systems.
• Its modular architecture bridges multiple programming languages (Python, C#, C++, PowerShell) to evade detection; Expel reverse-engineered it and used a honeypot to capture attacker tooling.

“The malware attempts to phish the user's system login credentials by creating a fake lock screen. It then loads a network tunneling module to enable the threat actors to log into internal and external company systems via the infected user's machine.”

Expel, Security research firm · Expel blog · Aug 19

Expel Security research firmmalwaretech Security researcher