Microsoft Teams Phishing Deploys New SynkLoader Malware to Steal Windows Passwords

Microsoft Teams phishing is again being used as a doorway to deliver a malware family called SynkLoader.

The campaign relies on a familiar social-engineering trick: an attacker poses as an IT helpdesk worker and persuades an employee to install what appears to be a useful fix.

It deploys a layered toolkit that hides much of its activity in memory, gathers details about the victim’s Windows system, and maintains a channel back to the operators. That gives a Teams chat the potential to become a serious corporate network intrusion.

Analysts at Expel identified the malware during an investigation. The components appeared new, with compilation and file timestamps indicating the toolkit was first built and distributed around July 28, 2026.