PhishLocker (Malware): news timeline & CVEs

Hackers Impersonate IT Help Desk on Microsoft Teams to Steal Windows Passwords

Attackers impersonate IT help desks in Microsoft Teams to deliver SynkLoader and steal Windows passwords.

Attackers are using Microsoft Teams external chats from Microsoft 365 tenants they control to impersonate IT help desks and trick employees into installing malware or approving remote access. One campaign delivered SynkLoader as a malicious MSI hosted on Azure storage; it can run largely in memory and persist through scheduled tasks. Its PhishLocker module displays a fake Windows lock screen that captures the password the user types. Microsoft recommends restricting Teams external access to trusted domains and verifying unexpected support requests through a known internal channel.

Cyber Security NewsSep 22, 04:46 UTC · 5d agoPhishing & fraud in the wild 2 sources1

Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords

Threat actors impersonate IT support in Microsoft Teams chats to deliver SynkLoader malware and harvest Windows credentials via fake lock screens.

Attackers create Microsoft 365 tenants with display names like 'IT Service Desk' and contact victims through Teams external access, often using .onmicrosoft.com addresses and professional profile photos to appear legitimate. A documented campaign delivered a 'PowershellCleaner' MSI from Azure Blob Storage that installs SynkLoader, a multi-language loader using Python, PowerShell, C#, and C++ with in-memory loading and scheduled-task persistence. Its PhishLocker module shows a fake full-screen lock screen reusing the device's real wallpaper to capture plaintext credentials, and a reverse proxy routes attacker traffic through the compromised host. Other campaigns abused Quick Assist for interactive control, then used Rclone for reconnaissance, lateral movement, and exfiltration.

GBHackersupdated Sep 22, 04:46 UTC · 5d agofirst Sep 21, 09:09 UTC · 6d agoThreat actor in the wild 2 sources

PhishLocker

Timeline2 articles

Appears with

Hackers Impersonate IT Help Desk on Microsoft Teams to Steal Windows Passwords

Hackers Abuse Microsoft Teams to Pose as IT Support and Steal Employee Passwords